Domain 5 · Objective reference 5.4 · Chapter 35 of 62
Authorization models, decisions and enforcement
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: The decision point decides; the enforcement point applies.
Explore the anchors
Describe subject action object and context.
Concept matching activity
Match this task or description to its concept:
Evaluate policy and relevant attributes.
Choose a concept before checking the explanation.
Access-decision sandbox
Try to edit a fictional record as a reader. Then change one condition and evaluate again. This simplified policy requires authentication, object scope and action permission; real policies have more conditions.
Change the request, then evaluate it.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
- Compare authorization models at the enforcement point
Concepts and mechanisms
Discretionary models allow owner or delegated grants within system rules; mandatory models apply central labels and clearances; role-based models group job permissions. Rule-based policies express conditions, while attribute-based decisions can combine subject, resource, action and environment properties. Risk-adaptive decisions add evaluated context, but the input’s reliability and the consequences of an incorrect denial or grant still matter.
Design, evidence and tradeoffs
Separate the policy decision point from the enforcement point. Correct rules are ineffective if an alternate endpoint bypasses enforcement. Evaluate inherited rights, object ownership, privilege levels and temporary access. Multi-factor authentication does not repair excessive permission. Test representative permitted and forbidden actions and investigate conflicting rules. Dynamic decisions need explainable operation and an accountable exception or recovery route.
Compare authorization models at the enforcement point
Mandatory access control applies centrally governed labels and rules; discretionary access control permits authorized owners to delegate within policy. Role-based access control groups permissions by role; attribute-based access control evaluates attributes and context. Rule-based controls apply explicit rules, while risk-based decisions consider evaluated risk signals. The policy decision point determines a decision and the policy enforcement point applies it. A correct decision that is bypassed on another API route still fails to protect the object. Audit both the policy and every relevant enforcement path.
Worked example
A role permits invoice preparation, resource attributes limit the project, and a separate approver releases payment.
Check your understanding
What distinguishes an attribute-based restriction from a role label?
Show explanation
It constrains an operation using relevant properties of the particular request or resource, not only a job grouping.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.