authorization-enforcementAuthorization Enforcement
Enforce authorization at every protected server-side boundary.
Production domain 04
Identity, Authorization & Tenant Isolation
3 capabilities and 3 controls define the canonical obligation set for this domain.
Applicability and claim boundary
This domain defines obligations. It does not prove that a specific repository or run satisfies them.
- Applicability
- Assess this domain when the authorized workload can affect its capabilities. Resolve every control as required, potentially affected, or not applicable before completion.
- Proof level
- The accepted formats below identify possible evidence inputs. A format alone does not establish semantic or authoritative assurance; provenance and the commissioned proof contract set the supported level.
- Claim boundary
- Static controls are requirements, not execution evidence, provider attestation, or proof of production readiness.
Capabilities
tenant-isolationTenant Isolation
Prevent cross-tenant reads, writes, and side-channel disclosure.
identity-lifecycleIdentity Lifecycle
Govern sessions, credentials, identities, and deprovisioning end to end.
Controls
AUTH-AUTHZ-001Authorization EnforcementEvery protected operation enforces server-side authorization.
Accepted evidence format: Command outputAUTH-TENANT-001Tenant IsolationCross-tenant read and write attempts fail at every relevant boundary.
Accepted evidence format: Command outputAUTH-LIFECYCLE-001Identity LifecycleSessions, identities, keys, and deprovisioning have tested lifecycles.
Accepted evidence format: Command output