Security Engineering · Cluster
Authorization
Access control models and policy enforcement.
- 01 Reference Monitors and Complete Mediation in Access Control Why an access check only means something if every access passes through it, how the policy decision point is separated from the enforcement point, and where check-then-use gaps appear.
- 02 POSIX Mode Bits, umask, and the ACL Mask Interaction How the nine permission bits, the setuid and sticky bits, umask filtering, and POSIX ACL entries combine into one effective permission, and why chmod rewrites an ACL mask.
- 03 Role Hierarchies and the Reachability Problem in RBAC How role-based access control assigns permissions through roles, why the role hierarchy is a partial order, and why reachability queries and separation-of-duty constraints dominate evaluation cost.
- 04 Attribute-Based Policy Evaluation and Combining Algorithms How XACML-style policies decide by matching attributes and combining rule effects, why deny-overrides is not the same as first-applicable, and what obligations and indeterminate results cost.
- 05 Object Capabilities and the Confused Deputy How unforgeable references replace identity checks, why ambient authority enables the confused deputy, and what membrane and revocation designs cost in a capability system.
- 06 Relationship Graphs and How ReBAC Checks Resolve Access How relationship tuples model authorization as graph traversal, why depth-bounded checks are the practical answer, and where cycles and fan-out break naive evaluation.
- 07 Policy as Code: Decision Engines and Deterministic Evaluation How a general-purpose policy engine turns rules into a decision, why partial evaluation produces residual queries, and what non-determinism costs an authorization system.
- 08 Authorization Models for Multi-Tenant Data Isolation How tenant identity must be bound into every query and token, why row-level filtering fails when it is optional, and what isolation guarantees separate deployments actually provide.
- 09 Constrained Delegation and Token Exchange in OAuth 2.0 How the token exchange grant carries a subject through a chain of services, what scopes and audience restrict, and why impersonation and delegation differ in what the audit log records.
- 10 Administrative Models, Safety Analysis, and Sandhu's Schematic Protection Model How to reason about whether a protection system can leak a right, why safety is undecidable in general, and which restricted models admit tractable analysis.