Is this user generally allowed to perform this kind of operation?
Is this user related to this specific object?
Is this operation allowed under the current object state and environment?
Is there a policy override, regulatory restriction, delegation, or separation-of-duty rule?
What fields may be seen or changed?
How should the decision be audited?

RBAC answers: what capability does the subject generally have?
ReBAC answers: how is the subject connected to this object?
ABAC answers: under what contextual conditions is the operation valid?
PBAC answers: what governed policy says allow, deny, obligations, and advice?
Query scoping answers: how do we make unauthorized rows unreachable by construction?
Field authorization answers: which parts of the object are visible or writable?

Which access-control fact belongs to which model, at which layer, with which consistency, latency, audit, and failure semantics?

ROLE_JAKARTA_SENIOR_CASE_APPROVER_FOR_HIGH_RISK_CASES_TEMPORARY_DELEGATE

public enum DecisionEffect {
    ALLOW,
    DENY,
    INDETERMINATE
}

public enum DecisionSource {
    RBAC,
    TENANT,
    REBAC,
    ABAC,
    PBAC,
    FIELD_POLICY,
    QUERY_SCOPE
}

public record DecisionReason(
        DecisionSource source,
        String code,
        String message,
        Map<String, Object> evidence
) {}

public record Obligation(
        String type,
        Map<String, Object> parameters
) {}

public record AuthorizationDecision(
        DecisionEffect effect,
        List<DecisionReason> reasons,
        List<Obligation> obligations,
        String policyVersion,
        boolean cacheable,
        Duration maxTtl
) {
    public boolean allowed() {
        return effect == DecisionEffect.ALLOW;
    }
}

public enum CaseAction {
    VIEW,
    VIEW_RESTRICTED_FIELDS,
    UPDATE_SUMMARY,
    ASSIGN_INVESTIGATOR,
    SUBMIT_FOR_APPROVAL,
    APPROVE_ENFORCEMENT_ACTION,
    REJECT_ENFORCEMENT_ACTION,
    EXPORT_CASE_FILE,
    CLOSE_CASE
}

public enum CaseState {
    DRAFT,
    UNDER_INVESTIGATION,
    PENDING_APPROVAL,
    APPROVED,
    REJECTED,
    CLOSED
}

public enum Classification {
    PUBLIC,
    INTERNAL,
    CONFIDENTIAL,
    RESTRICTED,
    SECRET
}

public record SubjectRef(
        String subjectId,
        String tenantId,
        Set<String> roles,
        Set<String> permissions,
        Set<String> jurisdictions,
        Classification clearance,
        boolean breakGlassActive
) {}

public record CaseResource(
        String caseId,
        String tenantId,
        CaseState state,
        Classification classification,
        String jurisdiction,
        String createdBy,
        String assignedTeam,
        boolean legalHold,
        boolean sealed
) {}

public record AuthorizationContext(
        Instant now,
        String requestId,
        String clientId,
        String ipAddress,
        String deviceTrustLevel,
        boolean interactiveUser,
        Map<String, Object> extra
) {}

public record CaseAuthorizationRequest(
        SubjectRef subject,
        CaseAction action,
        CaseResource resource,
        AuthorizationContext context
) {}

public interface AuthorizationRule<R> {
    AuthorizationDecision evaluate(R request);
}

public final class HybridAuthorizationEngine<R> {
    private final List<AuthorizationRule<R>> rules;
    private final DecisionCombiner combiner;

    public HybridAuthorizationEngine(List<AuthorizationRule<R>> rules,
                                     DecisionCombiner combiner) {
        this.rules = List.copyOf(rules);
        this.combiner = combiner;
    }

    public AuthorizationDecision decide(R request) {
        List<AuthorizationDecision> partials = new ArrayList<>();

        for (AuthorizationRule<R> rule : rules) {
            AuthorizationDecision partial = rule.evaluate(request);
            partials.add(partial);

            if (combiner.canShortCircuit(partial)) {
                return combiner.combine(partials);
            }
        }

        return combiner.combine(partials);
    }
}

Explicit deny > indeterminate in mandatory gate > missing mandatory allow > allow

public final class DenyOverridesCombiner implements DecisionCombiner {
    @Override
    public boolean canShortCircuit(AuthorizationDecision decision) {
        return decision.effect() == DecisionEffect.DENY;
    }

    @Override
    public AuthorizationDecision combine(List<AuthorizationDecision> decisions) {
        List<DecisionReason> reasons = decisions.stream()
                .flatMap(d -> d.reasons().stream())
                .toList();

        List<Obligation> obligations = decisions.stream()
                .flatMap(d -> d.obligations().stream())
                .toList();

        boolean hasDeny = decisions.stream().anyMatch(d -> d.effect() == DecisionEffect.DENY);
        boolean hasIndeterminate = decisions.stream().anyMatch(d -> d.effect() == DecisionEffect.INDETERMINATE);

        if (hasDeny) {
            return new AuthorizationDecision(
                    DecisionEffect.DENY,
                    reasons,
                    obligations,
                    latestPolicyVersion(decisions),
                    false,
                    Duration.ZERO
            );
        }

        if (hasIndeterminate) {
            return new AuthorizationDecision(
                    DecisionEffect.DENY,
                    List.of(new DecisionReason(
                            DecisionSource.PBAC,
                            "AUTHZ_INDETERMINATE_FAIL_CLOSED",
                            "One or more mandatory authorization checks could not be evaluated",
                            Map.of("partialReasons", reasons)
                    )),
                    obligations,
                    latestPolicyVersion(decisions),
                    false,
                    Duration.ZERO
            );
        }

        return new AuthorizationDecision(
                DecisionEffect.ALLOW,
                reasons,
                obligations,
                latestPolicyVersion(decisions),
                decisions.stream().allMatch(AuthorizationDecision::cacheable),
                minimumTtl(decisions)
        );
    }

    private String latestPolicyVersion(List<AuthorizationDecision> decisions) {
        return decisions.stream()
                .map(AuthorizationDecision::policyVersion)
                .filter(Objects::nonNull)
                .max(String::compareTo)
                .orElse("unknown");
    }

    private Duration minimumTtl(List<AuthorizationDecision> decisions) {
        return decisions.stream()
                .map(AuthorizationDecision::maxTtl)
                .filter(Objects::nonNull)
                .min(Duration::compareTo)
                .orElse(Duration.ZERO);
    }
}

Does this subject generally have this business capability within this scope?

public final class CaseRbacRule implements AuthorizationRule<CaseAuthorizationRequest> {
    private final Map<CaseAction, String> requiredPermissionByAction = Map.of(
            CaseAction.VIEW, "case.view",
            CaseAction.UPDATE_SUMMARY, "case.update_summary",
            CaseAction.SUBMIT_FOR_APPROVAL, "case.submit_for_approval",
            CaseAction.APPROVE_ENFORCEMENT_ACTION, "case.approve_enforcement_action",
            CaseAction.EXPORT_CASE_FILE, "case.export"
    );

    @Override
    public AuthorizationDecision evaluate(CaseAuthorizationRequest request) {
        String required = requiredPermissionByAction.get(request.action());
        if (required == null) {
            return deny("RBAC_UNKNOWN_ACTION", "No permission mapping exists for action " + request.action());
        }

        if (!request.subject().permissions().contains(required)) {
            return deny("RBAC_PERMISSION_MISSING", "Subject lacks permission " + required);
        }

        return allow("RBAC_PERMISSION_PRESENT", Map.of("permission", required));
    }

    private AuthorizationDecision deny(String code, String message) {
        return new AuthorizationDecision(
                DecisionEffect.DENY,
                List.of(new DecisionReason(DecisionSource.RBAC, code, message, Map.of())),
                List.of(),
                "rbac-v1",
                false,
                Duration.ZERO
        );
    }

    private AuthorizationDecision allow(String code, Map<String, Object> evidence) {
        return new AuthorizationDecision(
                DecisionEffect.ALLOW,
                List.of(new DecisionReason(DecisionSource.RBAC, code, "RBAC gate passed", evidence)),
                List.of(),
                "rbac-v1",
                true,
                Duration.ofMinutes(5)
        );
    }
}

public final class TenantBoundaryRule implements AuthorizationRule<CaseAuthorizationRequest> {
    @Override
    public AuthorizationDecision evaluate(CaseAuthorizationRequest request) {
        if (!Objects.equals(request.subject().tenantId(), request.resource().tenantId())) {
            return new AuthorizationDecision(
                    DecisionEffect.DENY,
                    List.of(new DecisionReason(
                            DecisionSource.TENANT,
                            "TENANT_MISMATCH",
                            "Subject tenant does not match resource tenant",
                            Map.of(
                                    "subjectTenant", request.subject().tenantId(),
                                    "resourceTenant", request.resource().tenantId()
                            )
                    )),
                    List.of(),
                    "tenant-boundary-v1",
                    false,
                    Duration.ZERO
            );
        }

        return new AuthorizationDecision(
                DecisionEffect.ALLOW,
                List.of(new DecisionReason(
                        DecisionSource.TENANT,
                        "TENANT_MATCH",
                        "Tenant boundary passed",
                        Map.of("tenantId", request.subject().tenantId())
                )),
                List.of(),
                "tenant-boundary-v1",
                true,
                Duration.ofMinutes(10)
        );
    }
}

Is this subject related to this resource in a way that grants this relation/permission?

public interface RelationshipAuthorizationPort {
    boolean check(String user, String relation, String object, Map<String, Object> context);
}

public final class CaseRebacRule implements AuthorizationRule<CaseAuthorizationRequest> {
    private final RelationshipAuthorizationPort relationships;

    public CaseRebacRule(RelationshipAuthorizationPort relationships) {
        this.relationships = relationships;
    }

    @Override
    public AuthorizationDecision evaluate(CaseAuthorizationRequest request) {
        String relation = switch (request.action()) {
            case VIEW -> "viewer";
            case UPDATE_SUMMARY -> "editor";
            case SUBMIT_FOR_APPROVAL -> "editor";
            case APPROVE_ENFORCEMENT_ACTION -> "approver";
            case EXPORT_CASE_FILE -> "exporter";
            default -> "unknown";
        };

        if (relation.equals("unknown")) {
            return deny("REBACL_UNKNOWN_RELATION", "No relation mapping exists for action " + request.action());
        }

        boolean ok = relationships.check(
                "user:" + request.subject().subjectId(),
                relation,
                "case:" + request.resource().caseId(),
                Map.of("tenant", request.resource().tenantId())
        );

        if (!ok) {
            return deny("REBACL_RELATION_MISSING", "Subject lacks relation " + relation + " on case");
        }

        return allow("REBACL_RELATION_PRESENT", Map.of("relation", relation));
    }

    private AuthorizationDecision deny(String code, String message) {
        return new AuthorizationDecision(
                DecisionEffect.DENY,
                List.of(new DecisionReason(DecisionSource.REBAC, code, message, Map.of())),
                List.of(),
                "rebac-v1",
                false,
                Duration.ZERO
        );
    }

    private AuthorizationDecision allow(String code, Map<String, Object> evidence) {
        return new AuthorizationDecision(
                DecisionEffect.ALLOW,
                List.of(new DecisionReason(DecisionSource.REBAC, code, "ReBAC gate passed", evidence)),
                List.of(),
                "rebac-v1",
                true,
                Duration.ofSeconds(30)
        );
    }
}

Given the subject, object, action, and environment, is this operation allowed now?

public final class CaseAbacRule implements AuthorizationRule<CaseAuthorizationRequest> {
    @Override
    public AuthorizationDecision evaluate(CaseAuthorizationRequest request) {
        CaseResource resource = request.resource();
        SubjectRef subject = request.subject();

        if (resource.sealed() && !subject.permissions().contains("case.sealed.access")) {
            return deny("ABAC_SEALED_CASE", "Sealed cases require explicit sealed-case permission");
        }

        if (resource.legalHold() && request.action() == CaseAction.CLOSE_CASE) {
            return deny("ABAC_LEGAL_HOLD", "Case under legal hold cannot be closed");
        }

        if (subject.clearance().ordinal() < resource.classification().ordinal()) {
            return deny("ABAC_CLEARANCE_TOO_LOW", "Subject clearance is lower than resource classification");
        }

        if (!subject.jurisdictions().contains(resource.jurisdiction())) {
            return deny("ABAC_JURISDICTION_MISMATCH", "Subject is outside resource jurisdiction");
        }

        if (request.action() == CaseAction.EXPORT_CASE_FILE
                && !"MANAGED".equals(request.context().deviceTrustLevel())) {
            return deny("ABAC_UNTRUSTED_DEVICE", "Case export requires a managed device");
        }

        return new AuthorizationDecision(
                DecisionEffect.ALLOW,
                List.of(new DecisionReason(
                        DecisionSource.ABAC,
                        "ABAC_CONSTRAINTS_PASSED",
                        "ABAC constraints passed",
                        Map.of(
                                "classification", resource.classification().name(),
                                "jurisdiction", resource.jurisdiction(),
                                "deviceTrustLevel", request.context().deviceTrustLevel()
                        )
                )),
                List.of(),
                "abac-v1",
                false,
                Duration.ZERO
        );
    }

    private AuthorizationDecision deny(String code, String message) {
        return new AuthorizationDecision(
                DecisionEffect.DENY,
                List.of(new DecisionReason(DecisionSource.ABAC, code, message, Map.of())),
                List.of(),
                "abac-v1",
                false,
                Duration.ZERO
        );
    }
}

public final class SeparationOfDutyRule implements AuthorizationRule<CaseAuthorizationRequest> {
    private final CaseHistoryRepository caseHistoryRepository;

    public SeparationOfDutyRule(CaseHistoryRepository caseHistoryRepository) {
        this.caseHistoryRepository = caseHistoryRepository;
    }

    @Override
    public AuthorizationDecision evaluate(CaseAuthorizationRequest request) {
        if (request.action() != CaseAction.APPROVE_ENFORCEMENT_ACTION) {
            return allowNotApplicable();
        }

        boolean userSubmitted = caseHistoryRepository.wasSubmittedBy(
                request.resource().caseId(),
                request.subject().subjectId()
        );

        if (userSubmitted) {
            return new AuthorizationDecision(
                    DecisionEffect.DENY,
                    List.of(new DecisionReason(
                            DecisionSource.PBAC,
                            "PBAC_SOD_MAKER_CHECKER_VIOLATION",
                            "The maker of an enforcement action cannot approve the same action",
                            Map.of("caseId", request.resource().caseId())
                    )),
                    List.of(),
                    "sod-policy-v3",
                    false,
                    Duration.ZERO
            );
        }

        return new AuthorizationDecision(
                DecisionEffect.ALLOW,
                List.of(new DecisionReason(
                        DecisionSource.PBAC,
                        "PBAC_SOD_PASSED",
                        "Separation-of-duty policy passed",
                        Map.of()
                )),
                List.of(),
                "sod-policy-v3",
                false,
                Duration.ZERO
        );
    }

    private AuthorizationDecision allowNotApplicable() {
        return new AuthorizationDecision(
                DecisionEffect.ALLOW,
                List.of(new DecisionReason(
                        DecisionSource.PBAC,
                        "PBAC_NOT_APPLICABLE",
                        "Policy not applicable to action",
                        Map.of()
                )),
                List.of(),
                "sod-policy-v3",
                true,
                Duration.ofMinutes(5)
        );
    }
}

public record CaseScope(
        String tenantId,
        Set<String> allowedJurisdictions,
        Set<String> allowedTeamIds,
        boolean includeSealed,
        boolean includeRestricted,
        Set<CaseState> allowedStates
) {}

public interface CaseScopeResolver {
    CaseScope resolveScope(SubjectRef subject, CaseAction action, AuthorizationContext context);
}

SELECT c.*
FROM regulatory_case c
WHERE c.tenant_id = :tenant_id
  AND c.jurisdiction IN (:allowed_jurisdictions)
  AND c.assigned_team_id IN (:allowed_team_ids)
  AND (:include_sealed = true OR c.sealed = false)
  AND (:include_restricted = true OR c.classification <> 'RESTRICTED')
  AND c.state IN (:allowed_states)
ORDER BY c.updated_at DESC
LIMIT :limit OFFSET :offset;

public enum CaseField {
    CASE_ID,
    TITLE,
    SUMMARY,
    STATUS,
    ASSIGNED_TEAM,
    EVIDENCE_SUMMARY,
    WITNESS_DETAILS,
    CONFIDENTIAL_NOTES,
    INTERNAL_RISK_SCORE,
    LEGAL_HOLD_REASON
}

public record FieldDecision(
        CaseField field,
        boolean readable,
        boolean writable,
        String reasonCode
) {}

public interface CaseFieldPolicy {
    List<FieldDecision> decideFields(CaseAuthorizationRequest request);
}

public final class CaseDtoAssembler {
    private final CaseFieldPolicy fieldPolicy;

    public CaseResponse toResponse(CaseAuthorizationRequest request, Case caseEntity) {
        Map<CaseField, FieldDecision> decisions = fieldPolicy.decideFields(request).stream()
                .collect(Collectors.toMap(FieldDecision::field, Function.identity()));

        return new CaseResponse(
                caseEntity.id(),
                readable(decisions, CaseField.TITLE) ? caseEntity.title() : null,
                readable(decisions, CaseField.SUMMARY) ? caseEntity.summary() : null,
                readable(decisions, CaseField.WITNESS_DETAILS) ? caseEntity.witnessDetails() : "[REDACTED]",
                readable(decisions, CaseField.CONFIDENTIAL_NOTES) ? caseEntity.confidentialNotes() : "[REDACTED]"
        );
    }

    private boolean readable(Map<CaseField, FieldDecision> decisions, CaseField field) {
        return decisions.getOrDefault(field, new FieldDecision(field, false, false, "FIELD_DEFAULT_DENY"))
                .readable();
    }
}

public final class CaseWorkflowService {
    private final HybridAuthorizationEngine<CaseAuthorizationRequest> authz;
    private final CaseRepository cases;

    public void approve(String caseId, SubjectRef subject, AuthorizationContext context) {
        CaseResource resource = cases.loadResourceForAuthorization(caseId);

        AuthorizationDecision decision = authz.decide(new CaseAuthorizationRequest(
                subject,
                CaseAction.APPROVE_ENFORCEMENT_ACTION,
                resource,
                context
        ));

        if (!decision.allowed()) {
            throw new AccessDeniedException(decision.reasons().toString());
        }

        Case aggregate = cases.loadForUpdate(caseId);
        aggregate.approve(subject.subjectId(), context.now());
        cases.save(aggregate);
    }
}

API says allow.
Service says allow using different logic.
Repository scopes differently.
Async worker rechecks differently.
Audit logs a fourth version.

One canonical authorization request contract.
One canonical permission/action catalog.
One canonical reason-code catalog.
Layer-specific enforcement points, same decision model.
Policy/model version included everywhere.

public record AuthorizationCacheKey(
        String subjectId,
        String tenantId,
        String action,
        String resourceType,
        String resourceId,
        String resourceVersion,
        String policyVersion,
        String relationshipModelVersion,
        String deviceTrustLevel
) {}

{
  "decisionId": "dec-20260703-000001",
  "requestId": "req-abc",
  "subject": "user:alice",
  "tenant": "tenant:regulator-id",
  "action": "case.approve_enforcement_action",
  "resource": "case:CASE-123",
  "effect": "DENY",
  "reasons": [
    {
      "source": "PBAC",
      "code": "PBAC_SOD_MAKER_CHECKER_VIOLATION"
    }
  ],
  "policyVersion": "sod-policy-v3",
  "relationshipModelVersion": "case-authz-model-2026-07",
  "resourceVersion": "case-v17",
  "timestamp": "2026-07-03T10:15:30Z"
}

@ParameterizedTest
@MethodSource("cases")
void authorization_matrix_is_enforced(TestCase tc) {
    AuthorizationDecision decision = engine.decide(tc.request());
    assertThat(decision.effect()).isEqualTo(tc.expectedEffect());
    assertThat(decision.reasons())
            .extracting(DecisionReason::code)
            .contains(tc.expectedReasonCode());
}

No non-break-glass user can access cross-tenant resource.
No maker can approve own enforcement action.
No user below classification can view restricted fields.
No unscoped repository method is used by list endpoints.
No exported report contains fields denied by field policy.

old_engine(request) == new_engine(request)

RBAC = capability
ABAC = context and attributes
ReBAC = object relationship
PBAC = governed policy
Query scoping = authorize by construction
Field policy = safe representation
Audit = defensibility