Authorization Decision Integrity

Control Statement

Authorization policy shall be enforced at a decision point that every access path consults, and changes to that policy shall be controlled, logged and reviewable.

Purpose. To ensure the policy that governs movement is actually consulted and cannot be altered without trace.

Discussion

M3 Envelopment's precondition, in the framework's own words, is a policy decision point that something actually enforces — an authorization engine no service consults is a document, and it will score well. This control makes that testable in both directions: paths that bypass the decision point, and changes to policy that leave no trace. The second is the higher-value target. An adversary who can add a policy rule does not need to defeat any control in this family; they authorize themselves, and unless policy change is logged and reviewed against an expected-change baseline, the alteration is indistinguishable from routine administration.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

Inputs and Outputs

Activities

1. L2Enforce authorization policy at a defined decision point.
2. L2Log every change to authorization policy.
3. L2Record which access paths consult the decision point.
4. L3Enumerate access paths that do not consult the decision point and record each as a finding with an owner, since these are where envelopment fails.
5. L3Review policy changes against expected change, not merely retain the log — an unreviewed change log detects nothing.
6. L3Require authorization for policy change at a level above the access the policy governs, so self-authorization requires two failures rather than one.
7. L3Place change detection on the policy store itself and route it to a monitored path, consistent with KT-5 barrier monitoring.
8. L4Measure the proportion of access paths consulting the decision point, and trend it toward complete coverage.
9. L4Measure time to detect an unauthorized authorization policy change, tested rather than assumed.
10. L5Move toward policy as reviewed, version-controlled configuration, so change review is a property of the deployment process rather than a periodic audit.

Measurement

Evidence and Assessment

Related Guidance

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.