case.approve
case.evidence.read
case.assignment.change
case.export

Regional Case Approver - Jakarta
Fraud Evidence Reviewer - Tier 2
Temporary Enforcement Lead - Incident INC-2026-778
External Auditor - Read Only - Q3 Review

public record AccessRequestId(UUID value) {}
public record AccessGrantId(UUID value) {}
public record SubjectId(String value) {}
public record TenantId(String value) {}
public record ResourceScope(String type, String id) {}

public enum AccessRequestStatus {
    DRAFT,
    SUBMITTED,
    ELIGIBILITY_REJECTED,
    PENDING_APPROVAL,
    APPROVED,
    PROVISIONING,
    ACTIVE,
    REJECTED,
    CANCELLED,
    EXPIRED,
    REVOKED
}

public enum AccessDurationType {
    PERMANENT,
    TEMPORARY,
    JUST_IN_TIME,
    BREAK_GLASS
}

public record EntitlementRef(
    String entitlementCode,
    String version
) {}

public record AccessRequest(
    AccessRequestId id,
    TenantId tenantId,
    SubjectId requester,
    SubjectId targetSubject,
    EntitlementRef entitlement,
    ResourceScope scope,
    AccessDurationType durationType,
    Instant requestedFrom,
    Instant requestedUntil,
    String businessJustification,
    String ticketRef,
    AccessRequestStatus status,
    long version
) {}

public enum AccessGrantStatus {
    ACTIVE,
    SUSPENDED,
    EXPIRED,
    REVOKED
}

public record AccessGrant(
    AccessGrantId id,
    TenantId tenantId,
    SubjectId subject,
    EntitlementRef entitlement,
    ResourceScope scope,
    Instant effectiveFrom,
    Instant effectiveUntil,
    AccessGrantStatus status,
    String sourceRequestId,
    String approvedBy,
    String approvalEvidenceRef,
    String policyVersion,
    Instant createdAt,
    Instant updatedAt
) {
    public boolean isEffectiveAt(Instant now) {
        return status == AccessGrantStatus.ACTIVE
            && !now.isBefore(effectiveFrom)
            && (effectiveUntil == null || now.isBefore(effectiveUntil));
    }
}

@PreAuthorize("hasRole('ADMIN')")
@PostMapping("/users/{userId}/roles")
void assignRole(...) { ... }

access.request.submit
access.request.approve
access.request.reject
access.grant.revoke
access.grant.extend
access.entitlement.create
access.entitlement.update
access.policy.publish
access.breakglass.approve
access.review.certify

access.request.approve where entitlement.risk <= approver.maxRisk
access.grant.revoke where grant.tenant == approver.tenant
access.policy.publish where policy.domain == approver.domain
access.breakglass.approve where approver.isSecurityOfficer == true

public record ApprovalRequirement(
    List<ApprovalStep> steps,
    boolean sequential,
    String reasonCode
) {}

public record ApprovalStep(
    String stepCode,
    ApproverSelector selector,
    int minApprovals,
    boolean allowDelegatedApproval
) {}

public sealed interface ApproverSelector permits
    ManagerSelector,
    EntitlementOwnerSelector,
    SecurityOfficerSelector,
    ComplianceOfficerSelector,
    StaticGroupSelector {}

public record EntitlementRisk(
    String code,
    int riskLevel,
    boolean canGrantToSelf,
    boolean requiresExpiry,
    boolean requiresReview
) {}

public final class ApprovalPolicyService {
    public ApprovalRequirement determineRequirement(AccessRequest request, EntitlementRisk risk) {
        List<ApprovalStep> steps = new ArrayList<>();

        steps.add(new ApprovalStep(
            "MANAGER_APPROVAL",
            new ManagerSelector(request.targetSubject()),
            1,
            true
        ));

        if (risk.riskLevel() >= 3) {
            steps.add(new ApprovalStep(
                "ENTITLEMENT_OWNER_APPROVAL",
                new EntitlementOwnerSelector(request.entitlement()),
                1,
                false
            ));
        }

        if (risk.riskLevel() >= 4 || request.durationType() == AccessDurationType.BREAK_GLASS) {
            steps.add(new ApprovalStep(
                "SECURITY_APPROVAL",
                new SecurityOfficerSelector(request.tenantId()),
                1,
                false
            ));
        }

        return new ApprovalRequirement(steps, true, "APPROVAL_BY_RISK_LEVEL");
    }
}

public record SoDConstraint(
    String code,
    Set<String> incompatibleEntitlements,
    boolean exceptionAllowed,
    String exceptionApproverType
) {}

public final class StaticSoDService {
    private final AccessGrantRepository grants;
    private final SoDConstraintRepository constraints;

    public SoDResult evaluate(SubjectId subject, EntitlementRef requested, TenantId tenant) {
        Set<String> active = grants.findActiveEntitlementCodes(subject, tenant);
        List<SoDConstraint> relevant = constraints.findByEntitlement(requested.entitlementCode());

        for (SoDConstraint constraint : relevant) {
            Set<String> overlap = new HashSet<>(active);
            overlap.retainAll(constraint.incompatibleEntitlements());
            if (!overlap.isEmpty()) {
                return SoDResult.conflict(constraint.code(), overlap, constraint.exceptionAllowed());
            }
        }
        return SoDResult.noConflict();
    }
}

public AuthorizationDecision canApproveCase(Subject subject, CaseRecord record) {
    if (record.createdBy().equals(subject.id())) {
        return AuthorizationDecision.deny("SOD_CREATOR_CANNOT_APPROVE");
    }
    if (record.lastModifiedBy().equals(subject.id()) && record.modificationWasMaterial()) {
        return AuthorizationDecision.deny("SOD_MATERIAL_EDITOR_CANNOT_APPROVE");
    }
    return permissionCheck(subject, "case.approve", record.resourceRef());
}

Entitlement: Regional Case Approver - Jakarta
Allows:
- Read assigned enforcement cases in Jakarta
- Add comments and review notes
- Approve escalation from Investigation to Enforcement Review
Does not allow:
- Read sealed evidence
- Export case packets
- Reassign case owner
Scope: Region = ID-JK
Duration: 30 days
Risk: High
Requires: Manager + Case Governance Owner approval
SoD check: Cannot approve cases created by yourself

Admin selects user -> Add role -> Save

Admin selects target subject
-> chooses entitlement from catalog
-> selects scope
-> sees effective permissions and risk
-> provides reason/evidence
-> system evaluates admin authority + SoD + eligibility
-> approval workflow created if needed
-> grant provisioned only after approval

public record EntitlementDefinition(
    String code,
    String version,
    String displayName,
    String description,
    SubjectId owner,
    int riskLevel,
    Set<Permission> permissions,
    ScopeType requiredScopeType,
    Duration defaultDuration,
    Duration maxDuration,
    ReviewCadence reviewCadence,
    Set<String> incompatibleEntitlementCodes,
    ProvisioningMode provisioningMode,
    boolean selfServiceRequestable,
    boolean requiresBusinessJustification
) {}

insert into user_role(user_id, role) values (?, 'GLOBAL_ADMIN');

insert into access_grant(
    grant_id,
    tenant_id,
    subject_id,
    entitlement_code,
    scope_type,
    scope_id,
    effective_from,
    effective_until,
    status,
    source_request_id,
    approved_by,
    created_at
) values (...);

public boolean grantApplies(AccessGrant grant, Instant now, ResourceRef resource) {
    return grant.isEffectiveAt(now)
        && grant.scope().matches(resource)
        && grant.status() == AccessGrantStatus.ACTIVE;
}

public record BreakGlassContext(
    boolean active,
    String sessionId,
    String incidentRef,
    Instant expiresAt,
    String activatedBy
) {}

{
  "decision": "ALLOW",
  "reasonCode": "BREAK_GLASS_ACTIVE",
  "subject": "user:ops-17",
  "action": "case.evidence.read.sealed",
  "resource": "case:CASE-991",
  "breakGlassSessionId": "BG-2026-00087",
  "incidentRef": "INC-2026-4112",
  "policyVersion": "authz-policy-2026.07.03",
  "requiresPostUseReview": true
}

public record DelegationGrant(
    UUID id,
    TenantId tenantId,
    SubjectId delegator,
    SubjectId delegate,
    EntitlementRef delegatedEntitlement,
    ResourceScope scope,
    Instant effectiveFrom,
    Instant effectiveUntil,
    boolean redelegationAllowed,
    String reason,
    DelegationStatus status
) {}

public record ActingSubject(
    SubjectId actor,
    Optional<SubjectId> onBehalfOf,
    Set<String> authoritySources
) {}

actor = alice
onBehalfOf = bob
authoritySource = delegation:DEL-991
action = case.approve
resource = case:CASE-123

public record AccessReviewCampaign(
    UUID id,
    TenantId tenantId,
    String name,
    ReviewScope scope,
    Instant startsAt,
    Instant dueAt,
    ReviewCampaignStatus status,
    SubjectId owner,
    String reason
) {}

public record ReviewItem(
    UUID id,
    UUID campaignId,
    AccessGrantId grantId,
    SubjectId reviewer,
    ReviewItemStatus status,
    ReviewDecision decision,
    String decisionReason,
    Instant decidedAt
) {}

public enum ReviewDecision {
    KEEP,
    REVOKE,
    REDUCE_SCOPE,
    SHORTEN_DURATION,
    TRANSFER_OWNER,
    ESCALATE
}

Subject: jane.doe
Entitlement: Evidence Reviewer - Tier 2
Scope: Region ID-JK
Granted: 2026-02-10
Expires: none
Approved by: manager-81 + evidence-owner-4
Last used: 2026-03-01
Usage count last 90 days: 0
Risk: High
Recommended decision: Revoke or convert to temporary access

public ReviewRecommendation recommend(AccessGrant grant, UsageSummary usage, EntitlementDefinition entitlement) {
    if (entitlement.riskLevel() >= 4 && usage.lastUsedAt().isEmpty()) {
        return ReviewRecommendation.revoke("HIGH_RISK_NEVER_USED");
    }
    if (usage.daysSinceLastUse() > 180 && entitlement.riskLevel() >= 3) {
        return ReviewRecommendation.revoke("STALE_HIGH_RISK_ACCESS");
    }
    if (usage.usedPermissions().size() < entitlement.permissions().size() / 3) {
        return ReviewRecommendation.reduce("OVER_GRANTED_RELATIVE_TO_USAGE");
    }
    return ReviewRecommendation.keep("USAGE_WITHIN_EXPECTED_PATTERN");
}

public final class IdentityLifecycleHandler {
    private final AccessGrantRepository grants;
    private final AccessReviewService reviews;
    private final RevocationService revocation;

    public void onDepartmentChanged(DepartmentChangedEvent event) {
        List<AccessGrant> subjectGrants = grants.findActiveBySubject(event.subjectId());
        for (AccessGrant grant : subjectGrants) {
            if (grant.entitlement().requiresDepartmentEligibility()) {
                reviews.createTriggeredReview(
                    grant.id(),
                    "DEPARTMENT_CHANGED",
                    event.effectiveAt()
                );
            }
        }
    }

    public void onLeaver(LeaverEvent event) {
        revocation.revokeAllForSubject(
            event.subjectId(),
            "IDENTITY_LEAVER_EVENT",
            event.eventId()
        );
    }
}

public interface ProvisioningAdapter {
    ProvisioningResult provision(AccessGrant grant);
    ProvisioningResult deprovision(AccessGrant grant, String reason);
    ProvisioningDrift detectDrift(AccessGrant grant);
}

public final class AccessDriftDetector {
    public DriftReport compare(GovernedState governed, TargetState actual) {
        List<DriftFinding> findings = new ArrayList<>();

        for (ActualAssignment assignment : actual.assignments()) {
            if (!governed.hasMatchingGrant(assignment)) {
                findings.add(DriftFinding.unauthorizedAssignment(assignment));
            }
        }

        for (AccessGrant grant : governed.activeGrants()) {
            if (!actual.hasMatchingAssignment(grant)) {
                findings.add(DriftFinding.missingAssignment(grant));
            }
        }

        return new DriftReport(findings);
    }
}

{
  "eventType": "ACCESS_GRANT_CREATED",
  "eventId": "evt-01JZ-...",
  "tenantId": "tenant:regulator-id",
  "grantId": "grant:8f20",
  "subject": "user:analyst-22",
  "entitlement": "REGIONAL_CASE_APPROVER@2026.07",
  "scope": "region:ID-JK",
  "effectiveFrom": "2026-07-03T09:00:00Z",
  "effectiveUntil": "2026-08-03T09:00:00Z",
  "sourceRequestId": "access-request:991",
  "approvedBy": ["user:manager-8", "user:case-owner-2"],
  "policyVersion": "governance-policy-2026.07.03",
  "createdAt": "2026-07-03T08:55:10Z"
}

Before:
- case.read for region ID-JK
- case.comment.add for region ID-JK

After:
- case.read for region ID-JK
- case.comment.add for region ID-JK
- case.approve for region ID-JK
- case.evidence.read.redacted for region ID-JK

Risk delta:
- Grants workflow approval authority
- Grants access to redacted evidence metadata
- Requires case owner approval
- Dynamic SoD applies: cannot approve cases created by self

public record AccessModelChange(
    UUID id,
    String modelType,
    String modelCode,
    String fromVersion,
    String toVersion,
    String diffSummary,
    int affectedSubjectCount,
    Set<Permission> addedPermissions,
    Set<Permission> removedPermissions,
    ChangeRisk risk,
    ChangeStatus status
) {}

public record CustomRoleDefinition(
    String roleCode,
    String version,
    TenantId tenantId,
    SubjectId owner,
    String displayName,
    String description,
    Set<Permission> permissions,
    ScopeType allowedScopeType,
    int computedRiskLevel,
    boolean active
) {}

public record PrivilegedAccessActivation(
    UUID activationId,
    AccessGrantId baseGrantId,
    SubjectId actor,
    Instant activatedAt,
    Instant expiresAt,
    String reason,
    String ticketRef,
    ActivationStatus status
) {}

if (permission.isPrivileged()) {
    if (!privilegedAccess.isActive(subject.id(), permission, now)) {
        return AuthorizationDecision.deny("PRIVILEGED_ACCESS_NOT_ACTIVE");
    }
}

public record PrincipalContext(
    SubjectId actor,
    Optional<SubjectId> impersonatedSubject,
    Set<String> authenticationMethods,
    Set<String> authoritySources
) {
    public SubjectId effectiveSubject() {
        return impersonatedSubject.orElse(actor);
    }
}

user=jane action=profile.update

actor=support-17 effectiveSubject=jane action=profile.update mode=impersonation reason=TICKET-991

public record AccessEvidence(
    String evidenceType,
    String externalRef,
    String summary,
    SubjectId submittedBy,
    Instant submittedAt,
    boolean verified
) {}

Need access.

Incident INC-2026-477 requires Tier 2 evidence review for cases in region ID-JK until 2026-07-10. Approved by Case Governance Owner.

POST /access-requests
GET /access-requests/{id}
POST /access-requests/{id}/submit
POST /access-requests/{id}/cancel
GET /approval-tasks?assignedTo=me
POST /approval-tasks/{id}/approve
POST /approval-tasks/{id}/reject
GET /access-grants?subjectId=...
POST /access-grants/{id}/revoke
POST /access-grants/{id}/extend
POST /break-glass-sessions
POST /break-glass-sessions/{id}/close
POST /access-review-campaigns
POST /review-items/{id}/decide
GET /entitlements
GET /entitlements/{code}
POST /entitlements/{code}/versions

@PostMapping("/access-grants/{grantId}/revoke")
public ResponseEntity<Void> revoke(
    @PathVariable UUID grantId,
    @RequestBody RevokeGrantRequest body,
    Authentication authentication
) {
    Subject subject = subjectResolver.from(authentication);
    AccessGrant grant = grants.getRequired(grantId);

    authz.requireAllowed(AuthorizationRequest.builder()
        .subject(subject)
        .action("access.grant.revoke")
        .resource(ResourceRef.of("accessGrant", grantId.toString(), grant.tenantId().value()))
        .context(Map.of(
            "targetSubject", grant.subject().value(),
            "entitlement", grant.entitlement().entitlementCode(),
            "scope", grant.scope().id(),
            "riskLevel", entitlementRisk(grant.entitlement())
        ))
        .build());

    revocationService.revoke(grantId, subject.id(), body.reason(), body.evidenceRef());
    return ResponseEntity.noContent().build();
}

create table entitlement_definition (
    entitlement_code text not null,
    version text not null,
    display_name text not null,
    description text not null,
    owner_subject_id text not null,
    risk_level int not null,
    required_scope_type text not null,
    default_duration_seconds bigint,
    max_duration_seconds bigint,
    active boolean not null,
    created_at timestamptz not null,
    primary key (entitlement_code, version)
);

create table entitlement_permission (
    entitlement_code text not null,
    version text not null,
    permission_code text not null,
    primary key (entitlement_code, version, permission_code)
);

create table access_request (
    request_id uuid primary key,
    tenant_id text not null,
    requester_subject_id text not null,
    target_subject_id text not null,
    entitlement_code text not null,
    entitlement_version text not null,
    scope_type text not null,
    scope_id text not null,
    requested_from timestamptz not null,
    requested_until timestamptz,
    business_justification text not null,
    evidence_ref text,
    status text not null,
    version bigint not null,
    created_at timestamptz not null,
    updated_at timestamptz not null
);

create table access_grant (
    grant_id uuid primary key,
    tenant_id text not null,
    subject_id text not null,
    entitlement_code text not null,
    entitlement_version text not null,
    scope_type text not null,
    scope_id text not null,
    effective_from timestamptz not null,
    effective_until timestamptz,
    status text not null,
    source_request_id uuid,
    approved_by text,
    policy_version text not null,
    created_at timestamptz not null,
    updated_at timestamptz not null
);

create index idx_access_grant_subject_active
    on access_grant(tenant_id, subject_id, status, effective_until);

create index idx_access_grant_entitlement_scope
    on access_grant(tenant_id, entitlement_code, scope_type, scope_id, status);

access_requests_total{status, entitlement_risk}
approval_latency_seconds{risk_level}
access_grants_active{entitlement, scope_type, risk_level}
temporary_grants_expiring_soon_total
expired_grants_still_provisioned_total
revocation_latency_seconds{target_system}
access_review_overdue_total
breakglass_sessions_total{status}
breakglass_post_review_overdue_total
sod_conflicts_detected_total
unauthorized_drift_findings_total
policy_change_affected_subjects{risk_level}

@Test
void requesterCannotApproveOwnHighRiskAccessRequest() {
    AccessRequest request = fixtures.highRiskRequest()
        .requester("user:alice")
        .targetSubject("user:alice")
        .build();

    ApprovalDecision decision = approvalService.approve(
        request.id(),
        SubjectId.of("user:alice"),
        "looks good"
    );

    assertThat(decision.allowed()).isFalse();
    assertThat(decision.reasonCode()).isEqualTo("SELF_APPROVAL_DENIED");
}

@Test
void temporaryGrantIsNotEffectiveAfterExpiryEvenIfExpiryJobHasNotRun() {
    AccessGrant grant = fixtures.temporaryGrant()
        .effectiveUntil(Instant.parse("2026-07-03T10:00:00Z"))
        .status(AccessGrantStatus.ACTIVE)
        .build();

    boolean effective = grant.isEffectiveAt(Instant.parse("2026-07-03T10:00:01Z"));

    assertThat(effective).isFalse();
}

@Test
void roleChangeAddingSensitivePermissionRequiresSecurityApproval() {
    RoleChange change = fixtures.roleChange()
        .adds(Permission.CASE_EXPORT_ALL)
        .affectedSubjectCount(184)
        .build();

    ApprovalRequirement req = roleChangePolicy.determineRequirement(change);

    assertThat(req.steps()).extracting(ApprovalStep::stepCode)
        .contains("SECURITY_APPROVAL", "ENTITLEMENT_OWNER_APPROVAL");
}

select grant_id
from access_grant g
join entitlement_definition e
  on e.entitlement_code = g.entitlement_code
 and e.version = g.entitlement_version
where g.status = 'ACTIVE'
  and e.risk_level >= 4
  and g.effective_until is null;

com.example.authz.governance
├── api
│   ├── AccessRequestController.java
│   ├── ApprovalTaskController.java
│   ├── AccessGrantController.java
│   ├── EntitlementController.java
│   └── AccessReviewController.java
├── application
│   ├── AccessRequestService.java
│   ├── ApprovalWorkflowService.java
│   ├── GrantProvisioningService.java
│   ├── RevocationService.java
│   ├── AccessReviewService.java
│   ├── BreakGlassService.java
│   └── DriftDetectionService.java
├── domain
│   ├── AccessRequest.java
│   ├── AccessGrant.java
│   ├── EntitlementDefinition.java
│   ├── ApprovalRequirement.java
│   ├── SoDConstraint.java
│   ├── DelegationGrant.java
│   └── BreakGlassSession.java
├── policy
│   ├── ApprovalPolicyService.java
│   ├── EligibilityPolicyService.java
│   ├── SoDPolicyService.java
│   ├── DurationPolicyService.java
│   └── GovernanceAuthorizationService.java
├── provisioning
│   ├── ProvisioningAdapter.java
│   ├── LocalRbacProvisioningAdapter.java
│   ├── OpenFgaProvisioningAdapter.java
│   ├── CedarEntityProvisioningAdapter.java
│   └── OpaDataProvisioningAdapter.java
├── audit
│   ├── GovernanceAuditEvent.java
│   └── GovernanceAuditSink.java
└── persistence
    ├── AccessRequestRepository.java
    ├── AccessGrantRepository.java
    ├── EntitlementRepository.java
    └── ReviewRepository.java