Authorization and Privileged Access

What it is

Authorization decides what an authenticated identity may do. A sound design grants only what is needed, for only as long as needed, and proves later that it did so.

Privileged accounts, such as domain administrators and cloud root users, can change or disable every other control. They therefore get stronger protection and closer watching than ordinary accounts.

How it works

Access control models

RBAC is easy to audit but can suffer role explosion when needs are very specific. ABAC handles context such as time, device health or data sensitivity, but policies are harder to write and test. A hybrid design uses roles for the base and attributes for exceptions.

Core principles

Least privilege gives only the minimum permissions for the task. Separation of duties splits a sensitive process among several people, such as one who requests a payment and another who approves it.

Need to know limits access to information to those whose work requires it. Together they limit insider abuse and the damage of a stolen account.

Account life cycle

The joiner, mover and leaver pattern describes changes in a person's relationship with the organization. Joiners get access for their role, movers must lose old access when they change role, and leavers must be removed at once. Movers are the classic gap, because accumulated permissions create privilege creep.

Access reviews, also called recertification or attestation, ask managers or owners to confirm periodically that each person's access is still needed. Identity governance tools automate the campaign and record the evidence.

Privileged access management

Privileged access management (PAM) controls, protects and records the use of powerful accounts.

• Vaulting: admin passwords and keys sit in a vault, checked out for a session, then rotated.
• Just in time (JIT) access: privileges are granted for a short window on request and then removed, so standing privilege is minimized.
• Approval workflows: high risk access needs a second person.
• Session recording and monitoring: commands and screens are logged for review.
• Separate admin accounts: administrators use one everyday account and another for privileged tasks, from hardened workstations.
• Break glass accounts: emergency accounts are kept sealed, used rarely, and alert when used.

Service accounts, workloads and secrets

Applications and scripts need identities as well. Service accounts should have narrow rights, no interactive login, and owned, rotated credentials. In cloud platforms, workload identities and short lived tokens are better than long lived keys.

A secrets manager stores passwords, keys and tokens, controls who can read them, rotates them, and logs access. Secrets in source code, chat messages or configuration files are a common cause of breaches.

Policy architecture

Large systems separate where policy is decided from where it is enforced. A policy decision point evaluates rules, and a policy enforcement point applies the result at the resource. This split supports consistent policy across many applications and is the basis of zero trust designs.