中文
devexamples
← Workflows

阅读中文版本

Authorization Model Review Workflow

Document the authorization model, test role and permission boundaries, look for privilege creep, and adjust the model before it drifts from reality.

intermediate~120 minsecurityauthorizationgovernance

Objective

Review whether the authorization model still matches the intended access policy and closes gaps.

Environment

  • A role and permission catalog
  • Access logs and tests for boundary cases

Steps

1. Document roles, permissions, and the intended

Document roles, permissions, and the intended policy.

Expected state: The model is explicit and reviewable.

2. Test boundary cases: least-privilege roles, cross-tenant

Test boundary cases: least-privilege roles, cross-tenant access, admin paths.

Expected state: Gaps and over-permission are found.

3. Review actual assignments for privilege creep

Review actual assignments for privilege creep.

Expected state: Unexpected access is surfaced.

4. Adjust roles and tests to close

Adjust roles and tests to close the gaps.

Expected state: The model and reality converge.

Decision points

RBAC or ABAC?

  • RBAC with attributes
  • Pure RBAC

RBAC plus attribute conditions for object-level and tenant-level rules; pure RBAC cannot express ownership.

Who approves role changes?

  • Named approver
  • Any admin

A named approver with separation of duties; self-approval defeats the control.

Expected outcome

A reviewed authorization model with boundary tests, detected privilege creep, and adjustments that align access with intent.

Verification

Confirm boundary tests fail when a check is deliberately removed, and that no user holds a permission the model does not justify.

Cleanup

Record the review findings and update the role catalog version.

Overview

Review whether the authorization model still matches the intended access policy and closes gaps. Confirm boundary tests fail when a check is deliberately removed, and that no user holds a permission the model does not justify.

Steps

  1. Document roles, permissions, and the intended policy. Expected state: The model is explicit and reviewable.
  2. Test boundary cases: least-privilege roles, cross-tenant access, admin paths. Expected state: Gaps and over-permission are found.
  3. Review actual assignments for privilege creep. Expected state: Unexpected access is surfaced.
  4. Adjust roles and tests to close the gaps. Expected state: The model and reality converge.
// boundary test: user in another tenant must not read this object
const res = await api.get(`/orders/${otherTenantOrder}`, asTenantA);
expect(res.status).toBe(404);

Verification

  • A reviewed authorization model with boundary tests, detected privilege creep, and adjustments that align access with intent.

Decision points

  • RBAC or ABAC? Options: RBAC with attributes; Pure RBAC. Recommended: RBAC plus attribute conditions for object-level and tenant-level rules; pure RBAC cannot express ownership.
  • Who approves role changes? Options: Named approver; Any admin. Recommended: A named approver with separation of duties; self-approval defeats the control.