if (user.hasRole("ADMIN")) {
    // allow
}

Can user:123 approve case:CASE-2026-0042
when:
  tenant = "financial-services-authority"
  case.status = "UNDER_REVIEW"
  case.assignedSupervisorId = user:123
  case.riskLevel = "HIGH"
  user.department = "ENFORCEMENT"
  user.clearance >= case.requiredClearance
  user is not the maker of the same case transition
  current time is within business operating window
  policy version = 2026.07.01

boolean canApprove = user.hasRole("SUPERVISOR");

AuthorizationDecision decision = authorizationService.authorize(
    AuthorizationRequest.builder()
        .subject(Subject.user(userId))
        .action(Action.of("case.approve"))
        .resource(ResourceRef.of("case", caseId))
        .context(Context.of(
            "tenantId", tenantId,
            "caseStatus", caseStatus,
            "caseOwnerDepartment", ownerDepartment,
            "requesterDepartment", requesterDepartment,
            "makerUserId", makerUserId,
            "riskLevel", riskLevel
        ))
        .build()
);

Alice adalah support agent.
Alice membuka order milik Bob atas permintaan Bob.

principal = alice@company.com
actor     = employee:alice
subject   = employee:alice
resource  = order:ORD-123 owned by customer:bob
context   = purpose="customer-support", requestedBy="customer:bob"

actor: siapa yang secara teknis melakukan aksi
beneficiary / onBehalfOf: untuk siapa aksi dilakukan

internal employee
external customer
partner application
machine identity
batch processor
anonymous caller

public enum SubjectType {
    HUMAN_USER,
    CUSTOMER,
    EMPLOYEE,
    SERVICE,
    WORKER,
    SYSTEM,
    ANONYMOUS
}

public record Subject(
    SubjectType type,
    String id,
    String tenantId,
    Set<String> roles,
    Set<String> scopes,
    Map<String, Object> attributes
) {}

read, write, delete

case.create
case.view
case.viewEvidence
case.addEvidence
case.submitForReview
case.approve
case.reject
case.escalate
case.assignInvestigator
case.export
case.close
case.reopen

<resourceType>.<businessOperation>

order.create
order.view
order.cancel
order.refund
order.overridePrice
quote.approveDiscount
case.assign
case.escalate
document.download
document.share
report.exportSensitive

case.evidence.add
case.evidence.download
case.note.createInternal
case.note.createExternal

GET /api/v1/cases/{id}
POST /api/v1/cases/{id}/approval

case.view
case.approve

case:CASE-2026-0042
order:ORD-9981
document:DOC-31
attachment:ATT-7
customer:CUST-443
report:MONTHLY-ENFORCEMENT-2026-06

Case
├── Case summary
├── Internal notes
├── Evidence files
├── Legal assessment
├── Sanction recommendation
├── Decision letter
└── Audit trail

resource type     = case
resource instance = case:CASE-2026-0042

@PreAuthorize("hasAuthority('case.view')")
@GetMapping("/cases/{caseId}")
public CaseDto getCase(@PathVariable String caseId) {
    return caseService.getCase(caseId);
}

@GetMapping("/cases/{caseId}")
public CaseDto getCase(@PathVariable String caseId) {
    CaseRecord record = caseRepository.findRequired(caseId);
    authorizationService.verify(
        subjectProvider.currentSubject(),
        Action.of("case.view"),
        ResourceRef.of("case", caseId),
        AuthorizationContext.from(record)
    );
    return mapper.toDto(record);
}

select * from cases where id = :caseId

select *
from cases
where id = :caseId
  and tenant_id = :tenantId

Apakah subject ini boleh melakukan action ini terhadap resource instance ini dalam tenant ini?

Apakah resource ini ada?

tenantId
requestTime
requestIp
deviceTrustLevel
riskScore
caseStatus
caseClassification
requestPurpose
businessUnit
jurisdiction
channel
mfaLevel
tokenType
policyVersion
workflowStep

User boleh melihat case jika:
- user berada di tenant yang sama;
- user adalah assignee, supervisor, atau auditor;
- case tidak berstatus sealed;
- atau user memiliki break-glass access aktif;
- dan reason akses dicatat.

{
  "context": {
    "userId": "u-1",
    "resourceId": "case-1",
    "action": "case.approve"
  }
}

{
  "subject": { "type": "employee", "id": "u-1" },
  "action": "case.approve",
  "resource": { "type": "case", "id": "case-1" },
  "context": {
    "caseStatus": "UNDER_REVIEW",
    "makerUserId": "u-9",
    "riskLevel": "HIGH",
    "mfaLevel": 2
  }
}

Token JWT memuat department="ENFORCEMENT".
User dipindah ke department lain 2 menit lalu.
Token masih berlaku 1 jam.
Apakah user masih boleh mengakses case enforcement?

boolean allowed = authorizationService.isAllowed(...);

effect: ALLOW | DENY | NOT_APPLICABLE | INDETERMINATE
reasonCode
humanReadableReason
matchedPolicyId
policyVersion
obligations
advice
cacheTtl
attributesUsed
decisionTime
correlationId

ALLOW, tetapi response harus meredact field `sanctionRecommendation`.
ALLOW, tetapi wajib menulis audit reason.
ALLOW, tetapi harus minta second approver sebelum commit.
ALLOW, tetapi export harus diberi watermark.

ADVICE: user dapat meminta access melalui supervisor.
ADVICE: MFA level 2 diperlukan.
ADVICE: case sedang sealed oleh legal department.

public enum AuthorizationEffect {
    ALLOW,
    DENY,
    NOT_APPLICABLE,
    INDETERMINATE
}

public record AuthorizationDecision(
    AuthorizationEffect effect,
    String reasonCode,
    String reason,
    String policyId,
    String policyVersion,
    List<Obligation> obligations,
    Map<String, Object> evidence
) {
    public boolean isAllowed() {
        return effect == AuthorizationEffect.ALLOW;
    }
}

public record Obligation(
    String type,
    Map<String, Object> parameters
) {}

public void verify(AuthorizationDecision decision) {
    if (decision.effect() != AuthorizationEffect.ALLOW) {
        throw new AccessDeniedException(decision.reasonCode());
    }
}

if (decision.effect() == AuthorizationEffect.DENY) {
    throw new AccessDeniedException();
}
// NOT_APPLICABLE and INDETERMINATE accidentally pass

approve payment
close enforcement case
export customer data
download confidential document
change role assignment

allow read-only access to cached public catalog
allow service health check
allow already-authorized local operation with short-lived decision cache

public AuthorizationDecision onPdpTimeout(AuthorizationRequest request) {
    if (request.action().riskTier().isHighOrCritical()) {
        return AuthorizationDecision.deny(
            "AUTHZ_PDP_TIMEOUT_FAIL_CLOSED",
            "Authorization decision could not be obtained safely"
        );
    }

    return decisionCache.findFresh(request.cacheKey())
        .orElseGet(() -> AuthorizationDecision.deny(
            "AUTHZ_NO_FRESH_DECISION",
            "No fresh authorization decision available"
        ));
}

if (user.hasRole("ADMIN")) { ... }
if (user.getDept().equals(case.getDept())) { ... }
if (case.getOwnerId().equals(user.getId())) { ... }

External PDP hanya tahu role dan path endpoint.
Ia tidak tahu status case, maker-checker, clearance, assignment, atau sealed state.

Centralize decision contract and policy semantics.
Distribute enforcement to every execution path.
Keep domain facts close to authoritative data.

Invariant 1:
No user can read a case outside their tenant.

Invariant 2:
No user can approve a case they submitted.

Invariant 3:
No one can export sealed evidence without legal clearance.

Invariant 4:
Every access to confidential evidence must produce audit evidence.

Invariant 5:
A workflow transition must be authorized against the current persisted state, not stale client state.

Supervisor can approve high-risk cases.

A case can be approved only if:
- subject is an active employee;
- subject has permission case.approve;
- subject belongs to same tenant as the case;
- subject is assigned as supervisor for the case or belongs to the authorized escalation group;
- case.status is UNDER_REVIEW;
- subject is not the user who submitted the case for approval;
- subject clearance is greater than or equal to case.requiredClearance;
- if case.riskLevel is HIGH or CRITICAL, subject has completed MFA level 2 in this session;
- decision is recorded with policy version and reason code.

package com.example.authz;

import java.time.Instant;
import java.util.List;
import java.util.Map;
import java.util.Set;

public record AuthorizationRequest(
    Subject subject,
    Action action,
    ResourceRef resource,
    AuthorizationContext context,
    Instant requestedAt,
    String correlationId
) {}

public record Subject(
    SubjectType type,
    String id,
    String tenantId,
    Set<String> roles,
    Set<String> scopes,
    Map<String, Object> attributes
) {}

public enum SubjectType {
    EMPLOYEE,
    CUSTOMER,
    SERVICE,
    WORKER,
    SYSTEM,
    ANONYMOUS
}

public record Action(
    String name,
    RiskTier riskTier
) {
    public static Action of(String name) {
        return new Action(name, RiskTier.MEDIUM);
    }
}

public enum RiskTier {
    LOW,
    MEDIUM,
    HIGH,
    CRITICAL;

    public boolean isHighOrCritical() {
        return this == HIGH || this == CRITICAL;
    }
}

public record ResourceRef(
    String type,
    String id,
    String tenantId,
    Map<String, Object> attributes
) {
    public static ResourceRef of(String type, String id) {
        return new ResourceRef(type, id, null, Map.of());
    }
}

public record AuthorizationContext(
    Map<String, Object> values
) {
    public Object get(String key) {
        return values.get(key);
    }
}

public record AuthorizationDecision(
    AuthorizationEffect effect,
    String reasonCode,
    String reason,
    String policyId,
    String policyVersion,
    List<Obligation> obligations,
    Map<String, Object> evidence
) {
    public boolean isAllowed() {
        return effect == AuthorizationEffect.ALLOW;
    }

    public static AuthorizationDecision allow(String reasonCode, String reason) {
        return new AuthorizationDecision(
            AuthorizationEffect.ALLOW,
            reasonCode,
            reason,
            null,
            null,
            List.of(),
            Map.of()
        );
    }

    public static AuthorizationDecision deny(String reasonCode, String reason) {
        return new AuthorizationDecision(
            AuthorizationEffect.DENY,
            reasonCode,
            reason,
            null,
            null,
            List.of(),
            Map.of()
        );
    }
}

public enum AuthorizationEffect {
    ALLOW,
    DENY,
    NOT_APPLICABLE,
    INDETERMINATE
}

public record Obligation(
    String type,
    Map<String, Object> parameters
) {}

public interface AuthorizationService {
    AuthorizationDecision authorize(AuthorizationRequest request);

    default void verify(AuthorizationRequest request) {
        AuthorizationDecision decision = authorize(request);
        if (!decision.isAllowed()) {
            throw new AccessDeniedException(decision.reasonCode());
        }
    }
}

public class AccessDeniedException extends RuntimeException {
    private final String reasonCode;

    public AccessDeniedException(String reasonCode) {
        super("Access denied: " + reasonCode);
        this.reasonCode = reasonCode;
    }

    public String reasonCode() {
        return reasonCode;
    }
}

Regulatory enforcement lifecycle platform.
A case can be submitted by investigator.
Supervisor can approve or reject.
High-risk case requires legal reviewer.
Maker cannot approve their own submission.
Sealed case requires special clearance.

Action approveCase = new Action("case.approve", RiskTier.HIGH);

ResourceRef caseResource = new ResourceRef(
    "case",
    caseRecord.id(),
    caseRecord.tenantId(),
    Map.of(
        "status", caseRecord.status(),
        "riskLevel", caseRecord.riskLevel(),
        "classification", caseRecord.classification(),
        "requiredClearance", caseRecord.requiredClearance(),
        "assignedSupervisorId", caseRecord.assignedSupervisorId(),
        "submittedBy", caseRecord.submittedBy()
    )
);

AuthorizationContext context = new AuthorizationContext(Map.of(
    "mfaLevel", session.mfaLevel(),
    "requestPurpose", "case-approval",
    "channel", "backoffice-web",
    "ipAddress", request.ipAddress()
));

public final class CaseApprovalPolicy implements AuthorizationPolicy {

    @Override
    public AuthorizationDecision evaluate(AuthorizationRequest request) {
        if (!request.action().name().equals("case.approve")) {
            return new AuthorizationDecision(
                AuthorizationEffect.NOT_APPLICABLE,
                "POLICY_NOT_APPLICABLE",
                "Policy does not handle this action",
                "case-approval-policy",
                "2026.07.01",
                List.of(),
                Map.of()
            );
        }

        Subject subject = request.subject();
        ResourceRef resource = request.resource();

        if (!"case".equals(resource.type())) {
            return AuthorizationDecision.deny(
                "AUTHZ_RESOURCE_TYPE_MISMATCH",
                "case.approve can only be applied to case resources"
            );
        }

        if (!subject.tenantId().equals(resource.tenantId())) {
            return AuthorizationDecision.deny(
                "AUTHZ_CROSS_TENANT_DENIED",
                "Subject and resource tenant do not match"
            );
        }

        if (!subject.roles().contains("CASE_SUPERVISOR")) {
            return AuthorizationDecision.deny(
                "AUTHZ_MISSING_SUPERVISOR_ROLE",
                "Subject is not a case supervisor"
            );
        }

        String status = (String) resource.attributes().get("status");
        if (!"UNDER_REVIEW".equals(status)) {
            return AuthorizationDecision.deny(
                "AUTHZ_INVALID_CASE_STATUS",
                "Case must be under review before approval"
            );
        }

        String submittedBy = (String) resource.attributes().get("submittedBy");
        if (subject.id().equals(submittedBy)) {
            return AuthorizationDecision.deny(
                "AUTHZ_MAKER_CHECKER_VIOLATION",
                "Submitter cannot approve their own case"
            );
        }

        String assignedSupervisorId = (String) resource.attributes().get("assignedSupervisorId");
        if (!subject.id().equals(assignedSupervisorId)) {
            return AuthorizationDecision.deny(
                "AUTHZ_NOT_ASSIGNED_SUPERVISOR",
                "Subject is not assigned as supervisor for this case"
            );
        }

        return AuthorizationDecision.allow(
            "AUTHZ_CASE_APPROVAL_ALLOWED",
            "Subject is allowed to approve this case"
        );
    }
}

Subject-nya benar?
Action-nya terlalu kasar?
Resource instance-nya dicek?
Context pentingnya hilang?
Decision-nya fail-open?
Enforcement path-nya lengkap?
Audit-nya membuktikan apa?

GET /cases/CASE-2026-0042
PATCH /orders/ORD-123
DELETE /documents/DOC-9
POST /accounts/ACC-7/users

ID kami UUID, jadi aman.

Every object identifier supplied by client must be treated as untrusted and must be authorized.

subscription plan dianggap role;
OAuth scope dianggap permission final;
JWT claim dianggap authoritative state;
role dianggap object-level access;
feature flag dianggap authorization.

User punya entitlement premium-reporting-enabled.
Token punya scope reports:read.
User punya role ANALYST.
Policy menyatakan ANALYST boleh export report hanya untuk department-nya.
Resource report punya classification CONFIDENTIAL.
Context menunjukkan request berasal dari managed device.
Decision akhirnya allow/deny.

{
  "eventType": "AUTHORIZATION_DECISION",
  "decisionId": "dec-20260703-000001",
  "correlationId": "req-abc",
  "subject": {
    "type": "EMPLOYEE",
    "id": "u-123",
    "tenantId": "t-1"
  },
  "action": "case.approve",
  "resource": {
    "type": "case",
    "id": "CASE-2026-0042",
    "tenantId": "t-1"
  },
  "effect": "DENY",
  "reasonCode": "AUTHZ_MAKER_CHECKER_VIOLATION",
  "policyId": "case-approval-policy",
  "policyVersion": "2026.07.01",
  "evaluatedAt": "2026-07-03T10:30:00Z"
}

Siapa mencoba melakukan apa?
Terhadap objek apa?
Kapan?
Berdasarkan policy versi mana?
Kenapa allow/deny?
Atribut apa yang dipakai?
Apa obligation yang diterapkan?

Hide Approve button if user cannot approve.

Every server-side action must be independently authorized.

1. Buat endpoint.
2. Buat service.
3. Buat query.
4. Tambah @PreAuthorize belakangan.

1. Definisikan protected resources.
2. Definisikan actions/business capabilities.
3. Definisikan subject types.
4. Definisikan relationships dan attributes yang diperlukan.
5. Definisikan invariants.
6. Definisikan enforcement points.
7. Definisikan decision/audit contract.
8. Implement endpoint/service/query.
9. Tulis negative tests dan abuse tests.

GET /cases/CASE-2026-0042

Can subject view case CASE-2026-0042?

Allow if:
- same tenant;
- subject is assigned investigator; or
- subject is assigned supervisor; or
- subject is auditor with audit assignment; or
- subject has legal reviewer role and case requires legal review;
- case is not sealed unless subject has sealed-case clearance;
- confidential fields are redacted unless subject has clearance.

manage case

case.assignInvestigator
case.submitForReview
case.approve
case.close
case.reopen
case.exportEvidence

Apa tenant boundary-nya?
Siapa owner-nya?
Apa parent resource-nya?
Apa classification-nya?
Apa lifecycle state-nya?
Apa relationship yang menentukan visibility?

return false;

return AuthorizationDecision.deny(
    "AUTHZ_NOT_ASSIGNED_TO_CASE",
    "User is not assigned to this case"
);

system migration
emergency data fix
break-glass incident response
legal hold export

breakGlass.case.viewSealed
systemMigration.case.reindex
legalHold.document.export

if (currentUser.isAdmin()) {
    return repository.findAll();
}

admin tetap subject yang harus melewati policy:
- admin action apa?
- resource apa?
- tenant apa?
- purpose apa?
- apakah break-glass?

{
  "caseId": "CASE-1",
  "caseOwnerUserId": "u-123",
  "caseStatus": "UNDER_REVIEW"
}

caseRecord.approve(currentUser.id());
caseRepository.save(caseRecord);
authorizationService.verify(...);

return caseRepository.findAll(pageable);

CaseSearchScope scope = authorizationService.searchScopeFor(
    subject,
    Action.of("case.search"),
    tenantId
);
return caseRepository.search(scope, criteria, pageable);

f(subject, action, resource, context) -> decision

identity facts
+ domain facts
+ relationship facts
+ contextual facts
+ policy rules
+ enforcement point
+ audit evidence
+ failure semantics
= defensible authorization decision

POST /cases/{caseId}/approve

Authorization = subject + action + resource + context -> decision + enforcement + audit