Observe first. Enforce where justified.
Start in observation, review the determinations, and decide where to enable enforcement. The organization defines how unresolved requirements are reviewed and where enforcement is enabled.
Authority reaches the result before the result takes effect.
A person, service, vendor, or agent proposes a result. Authority Control evaluates the result against current applicable authority and records the determination.
Organizational authority
The policies, delegations, and commitments the organization already operates under.
A consequential action is proposed
A payment, a data release, a system change, or an obligation.
The commitment boundary
The proposed result is evaluated against established authority before it can bind the organization.
A durable record
What was proposed, on what authority, and what the organization decided.
Every result receives Permit, Defer, or Block.
Every governed result receives one of three determinations.
Permit
The proposed result is within authority and may proceed. Permit does not establish that execution occurred.
Defer
The authority question is unresolved. On an enforcement-enabled path, the result is held while the organization’s process supplies the required authority, evidence, or review.
Block
The proposed result is outside authority. On an enforcement-enabled path, it does not proceed. The determination is recorded.
Defer records that the result still requires authority, evidence, or review. The organization’s existing workflow handles the resolution process.
Coverage is a stated boundary.
Authority Control applies on paths that invoke the evaluation, and enforcement requires those paths to apply the determination. Unmediated or unknown paths remain outside enforcement, so integration must be reviewed as the environment changes.
Identity, access, and runtime controls remain in place.
Authority Control adds one determination alongside them: whether the identified organizational result may take effect. It relies on those controls for who is acting and what they can reach; those controls retain their existing roles. How Authority Control fits with existing controls →
Start where the behavior can be watched before it is enforced.
A design-partner engagement begins in observation on one consequential workflow and leaves enforcement as an accountable decision for the organization.