Permission Management

Overview#

Role-based access works well for broad control, but operational environments often require something finer. A senior analyst may need read access to all active cases in their department, write access only to their own, and no access to cases in a different department with a higher secrecy level. That kind of control requires attribute-based policies, not just role assignments.

The Permission Management module supports both, with real-time policy evaluation, temporal access, and delegation workflows that cover the access patterns found in law enforcement, intelligence, healthcare, and financial environments.

Key Features#

• Fine-Grained Permissions: Control access at the individual resource level with granular actions (read, write, delete, share, manage). Permissions can be assigned to users, roles, groups, or derived from organisational attributes automatically.

• Attribute-Based Access Control (ABAC): Define access policies based on user attributes (role, department, clearance level), resource attributes (classification, owner, type), and environmental attributes (time, location, device). Policies are evaluated in real time for every access decision, with no delay between policy change and effect.

• Permission Inheritance: Hierarchical permission models where permissions flow from organisation to department to team to individual. Override capabilities at each level allow exceptions without disrupting the broader inheritance chain.

• Temporal Permissions: Grant time-limited access that automatically expires, supporting contractor access windows, temporary project assignments, and emergency break-glass procedures without requiring manual revocation.

• Delegation Framework: Resource owners can delegate specific permissions to others with configurable depth limits, approval workflows, and automatic revocation when the delegation period expires.

• Policy-as-Code: Define authorisation policies programmatically for version control, testing, and automated deployment. Policies support complex logic including conditional rules, role combinations, and resource-specific constraints.

• Real-Time Permission Evaluation: Every access request is evaluated against current policies with minimal latency. Permission changes take effect immediately across the platform.

• Permission Analytics: Visualise effective permissions per user, identify over-privileged accounts, detect unused permissions, and generate access review reports that satisfy compliance requirements.

Use Cases#

• Intelligence organisations applying clearance-level policies so analysts can only access materials at or below their authorised secrecy level, enforced at the attribute level rather than by manual curation.
• Law enforcement agencies granting temporary elevated access to investigators on specific cases that expires automatically when the case closes.
• Government departments meeting zero-trust requirements where every access decision is evaluated against current policy rather than cached or assumed.
• Financial institutions enforcing segregation of duties policies that prevent users with trade execution permissions from also having settlement permissions.
• Healthcare providers scoping clinician access to patient records based on treating relationship attributes, not broad department-level grants.

Open Standards#

• OASIS XACML 3.0 (eXtensible Access Control Markup Language): The ABAC policy engine is implemented directly against the OASIS XACML 3.0 specification, using its defined attribute categories (subject, resource, action), policy structure, and Permit/Deny/NotApplicable/Indeterminate decision model to evaluate every access request in real time.
• OAuth 2.0 (RFC 6749): Authorisation server scopes carried in access tokens define the boundary of permitted operations; the permission engine validates these scopes alongside role and attribute claims before granting or denying access.
• JSON Web Token (RFC 7519): RS256-signed JWTs are the bearer of identity and permission claims (roles, scopes, clearance level, organisation context) that feed the ABAC policy evaluator on every request.
• SCIM 2.0 (RFC 7643 / RFC 7644): System for Cross-domain Identity Management is used to provision and synchronise users and groups from external identity directories into the permission model, keeping role and group assignments current without manual intervention.
• NIST SP 800-53 (Access Control family): The implementation maps to AC-3 (Access Enforcement), AC-6 (Least Privilege), and AU-2 (Event Logging) controls, providing the compliance baseline for environments subject to federal or equivalent national security standards.
• OWASP Application Security Verification Standard (ASVS) V1.4 / V4.1: ASVS control V1.4.5 mandates uniform ABAC enforcement across every API field, and V4.1.3 governs access-control decision consistency; both are explicitly referenced in the permission layer implementation.

Getting Started#

1. Define Permission Model: Map your organisational structure and resource types to the permission framework.
2. Create Policies: Define access policies based on roles, attributes, and resource classifications.
3. Assign Permissions: Grant initial permissions to users and groups based on their roles.
4. Enable Auditing: Configure permission change logging and access decision recording.
5. Schedule Reviews: Set up periodic access reviews to maintain least-privilege posture over time.

Last Reviewed: 2026-02-05 Last Updated: 2026-04-14