Apakah user punya role X?

Apakah identity ini cukup kuat untuk action ini?
Apakah actor benar-benar dibuktikan sebagai orang/entity itu?
Apakah authenticator yang dipakai cukup kuat?
Apakah federation assertion dari IdP cukup dipercaya?
Apakah session ini masih fresh?
Apakah operasi ini memerlukan step-up?

subject = user-123
client = case-management-ui
tenant = regulator-a
roles = investigator, case-reviewer

How confident are we that subject user-123 is really the actor right now,
and that the account was originally bound to the correct real-world/entity identity?

User exists in database = identity verified

hasRole('APPROVER') => allow approvePayment

allow approvePayment if:
- subject has approver entitlement for tenant;
- payment belongs to tenant;
- payment state is PENDING_APPROVAL;
- subject is not requester;
- subject IAL >= VERIFIED;
- current AAL >= MULTI_FACTOR;
- authentication age <= 10 minutes;
- federation/source is allowed for this action;
- no active account risk hold;
- audit event can be durably recorded.

Authorization = Permission + Context + Assurance + Risk + Evidence

public enum IdentityAssuranceLevel {
    UNKNOWN(0),
    SELF_ASSERTED(1),
    VERIFIED(2),
    HIGH_ASSURANCE(3);

    private final int rank;

    IdentityAssuranceLevel(int rank) {
        this.rank = rank;
    }

    public boolean atLeast(IdentityAssuranceLevel required) {
        return this.rank >= required.rank;
    }
}

public enum AuthenticatorAssuranceLevel {
    NONE(0),
    SINGLE_FACTOR(1),
    MULTI_FACTOR(2),
    PHISHING_RESISTANT(3);

    private final int rank;

    AuthenticatorAssuranceLevel(int rank) {
        this.rank = rank;
    }

    public boolean atLeast(AuthenticatorAssuranceLevel required) {
        return this.rank >= required.rank;
    }
}

public enum FederationAssuranceLevel {
    LOCAL_OR_UNKNOWN(0),
    BASIC_FEDERATION(1),
    MANAGED_FEDERATION(2),
    HIGH_ASSURANCE_FEDERATION(3);

    private final int rank;

    FederationAssuranceLevel(int rank) {
        this.rank = rank;
    }

    public boolean atLeast(FederationAssuranceLevel required) {
        return this.rank >= required.rank;
    }
}

public record AuthenticationEventContext(
        String subjectId,
        String issuer,
        String clientId,
        Instant authenticatedAt,
        IdentityAssuranceLevel ial,
        AuthenticatorAssuranceLevel aal,
        FederationAssuranceLevel fal,
        Set<String> authenticationMethods,
        String acr,
        String amr,
        boolean stepUp,
        String sessionId
) {
    public Duration ageAt(Instant now) {
        return Duration.between(authenticatedAt, now);
    }

    public boolean freshEnough(Duration maxAge, Instant now) {
        return !ageAt(now).minus(maxAge).isPositive();
    }
}

public record AssuranceRequirement(
        IdentityAssuranceLevel minimumIal,
        AuthenticatorAssuranceLevel minimumAal,
        FederationAssuranceLevel minimumFal,
        Duration maximumAuthenticationAge,
        boolean allowStepUp,
        boolean requirePhishingResistantForPrivilegedAdmin
) {
    public static AssuranceRequirement basicAuthenticated() {
        return new AssuranceRequirement(
                IdentityAssuranceLevel.SELF_ASSERTED,
                AuthenticatorAssuranceLevel.SINGLE_FACTOR,
                FederationAssuranceLevel.LOCAL_OR_UNKNOWN,
                Duration.ofHours(12),
                true,
                false
        );
    }

    public static AssuranceRequirement highRiskDecision() {
        return new AssuranceRequirement(
                IdentityAssuranceLevel.VERIFIED,
                AuthenticatorAssuranceLevel.MULTI_FACTOR,
                FederationAssuranceLevel.BASIC_FEDERATION,
                Duration.ofMinutes(10),
                true,
                false
        );
    }

    public static AssuranceRequirement platformPrivileged() {
        return new AssuranceRequirement(
                IdentityAssuranceLevel.HIGH_ASSURANCE,
                AuthenticatorAssuranceLevel.PHISHING_RESISTANT,
                FederationAssuranceLevel.MANAGED_FEDERATION,
                Duration.ofMinutes(5),
                true,
                true
        );
    }
}

public sealed interface AssuranceDecision permits AssuranceDecision.Satisfied,
        AssuranceDecision.StepUpRequired,
        AssuranceDecision.Denied {

    record Satisfied(Map<String, Object> evidence) implements AssuranceDecision {}

    record StepUpRequired(
            AuthenticatorAssuranceLevel requiredAal,
            Duration maximumAuthenticationAge,
            String reasonCode
    ) implements AssuranceDecision {}

    record Denied(String reasonCode, Map<String, Object> evidence) implements AssuranceDecision {}
}

@Component
public class AssuranceEvaluator {

    public AssuranceDecision evaluate(
            AuthenticationEventContext auth,
            AssuranceRequirement requirement,
            Instant now
    ) {
        Map<String, Object> evidence = new LinkedHashMap<>();
        evidence.put("ial", auth.ial().name());
        evidence.put("aal", auth.aal().name());
        evidence.put("fal", auth.fal().name());
        evidence.put("authenticatedAt", auth.authenticatedAt().toString());
        evidence.put("acr", auth.acr());
        evidence.put("amr", auth.amr());

        if (!auth.ial().atLeast(requirement.minimumIal())) {
            return new AssuranceDecision.Denied("IAL_TOO_LOW", evidence);
        }

        if (!auth.fal().atLeast(requirement.minimumFal())) {
            return new AssuranceDecision.Denied("FAL_TOO_LOW", evidence);
        }

        boolean aalOk = auth.aal().atLeast(requirement.minimumAal());
        boolean freshOk = auth.freshEnough(requirement.maximumAuthenticationAge(), now);

        if (aalOk && freshOk) {
            return new AssuranceDecision.Satisfied(evidence);
        }

        if (requirement.allowStepUp()) {
            String reason = !aalOk ? "AAL_TOO_LOW" : "AUTHENTICATION_TOO_OLD";
            return new AssuranceDecision.StepUpRequired(
                    requirement.minimumAal(),
                    requirement.maximumAuthenticationAge(),
                    reason
            );
        }

        return new AssuranceDecision.Denied(
                !aalOk ? "AAL_TOO_LOW" : "AUTHENTICATION_TOO_OLD",
                evidence
        );
    }
}

{
  "error": "step_up_required",
  "reason": "AUTHENTICATION_TOO_OLD",
  "required": {
    "minimumAal": "MULTI_FACTOR",
    "maximumAuthenticationAgeSeconds": 600
  },
  "correlationId": "corr-8ad7"
}

@PostMapping("/cases/{caseId}/approve")
public ResponseEntity<?> approveCase(
        @PathVariable String caseId,
        @RequestBody ApproveCaseRequest request,
        Authentication authentication,
        HttpServletRequest httpRequest
) {
    ActorContext actor = actorContextResolver.resolve(authentication, httpRequest);

    try {
        caseApprovalService.approve(actor, caseId, request.reason());
        return ResponseEntity.noContent().build();
    } catch (StepUpRequiredException ex) {
        return ResponseEntity.status(HttpStatus.FORBIDDEN)
                .body(new StepUpRequiredResponse(
                        "step_up_required",
                        ex.reasonCode(),
                        ex.requiredAal().name(),
                        ex.maximumAuthenticationAge().toSeconds(),
                        actor.correlationId()
                ));
    }
}

@Transactional
public void approve(ActorContext actor, String caseId, String reason) {
    CaseRecord caseRecord = caseRepository.findByIdForUpdate(caseId)
            .orElseThrow(() -> new NotFoundException("Case not found"));

    AuthorizationDecision authz = authorizationService.decide(
            AuthorizationRequest.forAction(actor, "case.approve", caseRecord.resourceRef())
    );

    if (!authz.allowed()) {
        audit.denied(actor, "case.approve", caseRecord.resourceRef(), authz);
        throw new AccessDeniedException("Not authorized");
    }

    AssuranceDecision assurance = assuranceEvaluator.evaluate(
            actor.authenticationEvent(),
            AssuranceRequirement.highRiskDecision(),
            clock.instant()
    );

    switch (assurance) {
        case AssuranceDecision.Satisfied satisfied -> {
            caseRecord.approve(actor.subjectId(), reason);
            audit.allowed(actor, "case.approve", caseRecord.resourceRef(), authz, satisfied.evidence());
        }
        case AssuranceDecision.StepUpRequired stepUp -> {
            audit.stepUpRequired(actor, "case.approve", caseRecord.resourceRef(), stepUp.reasonCode());
            throw new StepUpRequiredException(
                    stepUp.requiredAal(),
                    stepUp.maximumAuthenticationAge(),
                    stepUp.reasonCode()
            );
        }
        case AssuranceDecision.Denied denied -> {
            audit.denied(actor, "case.approve", caseRecord.resourceRef(), denied.reasonCode(), denied.evidence());
            throw new AccessDeniedException("Assurance requirement not met");
        }
    }
}

{
  "iss": "https://idp.example.com/realms/regulator-a",
  "sub": "248289761001",
  "aud": "case-api",
  "azp": "case-ui",
  "exp": 1782630000,
  "iat": 1782626400,
  "auth_time": 1782629700,
  "acr": "urn:example:aal:2",
  "amr": ["pwd", "otp"],
  "tenant_id": "regulator-a",
  "scope": "case:read case:approve"
}

@ConfigurationProperties(prefix = "security.assurance")
public record AssuranceMappingProperties(
        Map<String, IssuerAssuranceMapping> issuers
) {}

public record IssuerAssuranceMapping(
        String issuer,
        Map<String, AuthenticatorAssuranceLevel> acrToAal,
        Map<String, IdentityAssuranceLevel> tenantDefaultIal,
        FederationAssuranceLevel federationAssuranceLevel
) {}

security:
  assurance:
    issuers:
      regulator-a:
        issuer: "https://idp.example.com/realms/regulator-a"
        federation-assurance-level: MANAGED_FEDERATION
        acr-to-aal:
          "urn:example:aal:1": SINGLE_FACTOR
          "urn:example:aal:2": MULTI_FACTOR
          "urn:example:aal:3": PHISHING_RESISTANT
        tenant-default-ial:
          "regulator-a": VERIFIED

@Component
public class OidcAssuranceMapper {

    private final AssuranceMappingProperties properties;

    public OidcAssuranceMapper(AssuranceMappingProperties properties) {
        this.properties = properties;
    }

    public AuthenticationEventContext map(Jwt jwt) {
        String issuer = jwt.getIssuer().toString();
        IssuerAssuranceMapping mapping = findMapping(issuer);

        String acr = jwt.getClaimAsString("acr");
        AuthenticatorAssuranceLevel aal = mapping.acrToAal()
                .getOrDefault(acr, AuthenticatorAssuranceLevel.SINGLE_FACTOR);

        String tenantId = jwt.getClaimAsString("tenant_id");
        IdentityAssuranceLevel ial = mapping.tenantDefaultIal()
                .getOrDefault(tenantId, IdentityAssuranceLevel.UNKNOWN);

        Instant authTime = jwt.getClaimAsInstant("auth_time");
        if (authTime == null) {
            authTime = jwt.getIssuedAt();
        }

        return new AuthenticationEventContext(
                jwt.getSubject(),
                issuer,
                jwt.getClaimAsString("azp"),
                authTime,
                ial,
                aal,
                mapping.federationAssuranceLevel(),
                Set.copyOf(jwt.getClaimAsStringList("amr") == null ? List.of() : jwt.getClaimAsStringList("amr")),
                acr,
                String.valueOf(jwt.getClaim("amr")),
                false,
                jwt.getId()
        );
    }

    private IssuerAssuranceMapping findMapping(String issuer) {
        return properties.issuers().values().stream()
                .filter(m -> m.issuer().equals(issuer))
                .findFirst()
                .orElseThrow(() -> new BadCredentialsException("Untrusted issuer for assurance mapping"));
    }
}

public record AccountSecurityState(
        String subjectId,
        long securityVersion,
        Instant credentialsChangedAt,
        Instant mfaChangedAt,
        Instant rolesChangedAt,
        boolean disabled,
        boolean riskHold
) {}

{
  "sub": "user-123",
  "security_version": 42,
  "iat": 1782626400
}

public void validateSecurityState(Jwt jwt, AccountSecurityState state) {
    Long tokenVersion = jwt.getClaim("security_version");
    if (tokenVersion == null || tokenVersion < state.securityVersion()) {
        throw new BadCredentialsException("Token security version is stale");
    }

    if (state.disabled() || state.riskHold()) {
        throw new BadCredentialsException("Account disabled or on risk hold");
    }
}

VIEW_CASE: authenticated session valid.
EXPORT_EVIDENCE: MFA within 15 minutes if outside managed network.
APPROVE_SANCTION: MFA within 10 minutes always.
GRANT_ADMIN: phishing-resistant auth within 5 minutes.
ROTATE_SIGNING_KEY: phishing-resistant auth within 5 minutes + second approver.

User did MFA at login this morning, therefore all privileged actions today are safe.

Privileged actions require recent proof of possession/presence appropriate to risk.

tenants:
  regulator-a:
    allowed-issuers:
      - "https://idp.regulator-a.example"
    subject-mapping: "issuer+sub"
    allowed-clients:
      - "case-ui"
      - "case-bff"
    federation-assurance: MANAGED_FEDERATION
    allowed-acr-values:
      - "urn:regulator-a:aal2"
      - "urn:regulator-a:aal3"
    jit-provisioning: false
    require-directory-membership: true

local account = email claim

local federated identity binding = issuer + stable subject + tenant relationship

public record FederatedIdentityBinding(
        String localSubjectId,
        String tenantId,
        String issuer,
        String issuerSubject,
        String displayEmail,
        FederationAssuranceLevel fal,
        Instant linkedAt,
        Instant lastSeenAt,
        boolean active
) {}

Login requires passkey + MFA.
Recovery only requires email link.
Attacker compromises email.
Attacker resets authenticator.
Attacker gains high-assurance account.

RECOVERY-001: Recovery flow must not create stronger access than the evidence collected.
RECOVERY-002: Authenticator reset must invalidate old sessions and refresh tokens.
RECOVERY-003: High-privilege account recovery must generate security alert and audit event.
RECOVERY-004: Newly recovered account may require cool-down or step-up before high-risk actions.
RECOVERY-005: Support-assisted recovery must record operator, reason, evidence reference, and approval path.

public enum ActionRiskTier {
    T1_BASIC,
    T2_SENSITIVE_READ,
    T3_SENSITIVE_WRITE,
    T4_HIGH_RISK_DECISION,
    T5_PLATFORM_PRIVILEGED
}

public record ActionPolicy(
        String action,
        ActionRiskTier riskTier,
        AssuranceRequirement assuranceRequirement,
        boolean requireAudit,
        boolean requireSegregationOfDuties,
        boolean allowImpersonation
) {}

@Component
public class ActionPolicyRegistry {

    private final Map<String, ActionPolicy> policies = Map.of(
            "case.read", new ActionPolicy(
                    "case.read",
                    ActionRiskTier.T2_SENSITIVE_READ,
                    new AssuranceRequirement(
                            IdentityAssuranceLevel.VERIFIED,
                            AuthenticatorAssuranceLevel.SINGLE_FACTOR,
                            FederationAssuranceLevel.BASIC_FEDERATION,
                            Duration.ofHours(8),
                            true,
                            false
                    ),
                    true,
                    false,
                    true
            ),
            "case.approve", new ActionPolicy(
                    "case.approve",
                    ActionRiskTier.T4_HIGH_RISK_DECISION,
                    AssuranceRequirement.highRiskDecision(),
                    true,
                    true,
                    false
            ),
            "platform.key.rotate", new ActionPolicy(
                    "platform.key.rotate",
                    ActionRiskTier.T5_PLATFORM_PRIVILEGED,
                    AssuranceRequirement.platformPrivileged(),
                    true,
                    true,
                    false
            )
    );

    public ActionPolicy get(String action) {
        ActionPolicy policy = policies.get(action);
        if (policy == null) {
            throw new IllegalArgumentException("Unknown action policy: " + action);
        }
        return policy;
    }
}

@Service
public class EnterpriseAuthorizationService {

    private final ActionPolicyRegistry actionPolicyRegistry;
    private final PermissionEvaluator permissionEvaluator;
    private final AssuranceEvaluator assuranceEvaluator;
    private final Clock clock;

    public EnterpriseAuthorizationService(
            ActionPolicyRegistry actionPolicyRegistry,
            PermissionEvaluator permissionEvaluator,
            AssuranceEvaluator assuranceEvaluator,
            Clock clock
    ) {
        this.actionPolicyRegistry = actionPolicyRegistry;
        this.permissionEvaluator = permissionEvaluator;
        this.assuranceEvaluator = assuranceEvaluator;
        this.clock = clock;
    }

    public EnterpriseDecision decide(AuthorizationRequest request) {
        ActionPolicy policy = actionPolicyRegistry.get(request.action());

        PermissionDecision permission = permissionEvaluator.evaluate(request);
        if (!permission.allowed()) {
            return EnterpriseDecision.deny("PERMISSION_DENIED", permission.evidence());
        }

        AssuranceDecision assurance = assuranceEvaluator.evaluate(
                request.actor().authenticationEvent(),
                policy.assuranceRequirement(),
                clock.instant()
        );

        return switch (assurance) {
            case AssuranceDecision.Satisfied satisfied ->
                    EnterpriseDecision.allow(policy.action(), merge(permission.evidence(), satisfied.evidence()));
            case AssuranceDecision.StepUpRequired stepUp ->
                    EnterpriseDecision.stepUpRequired(stepUp.reasonCode(), stepUp.requiredAal(), stepUp.maximumAuthenticationAge());
            case AssuranceDecision.Denied denied ->
                    EnterpriseDecision.deny(denied.reasonCode(), denied.evidence());
        };
    }

    private Map<String, Object> merge(Map<String, Object> a, Map<String, Object> b) {
        Map<String, Object> result = new LinkedHashMap<>(a);
        result.putAll(b);
        return result;
    }
}

{
  "error": "insufficient_assurance",
  "reason": "IAL_TOO_LOW",
  "message": "This action requires a verified identity.",
  "correlationId": "corr-019a"
}

{
  "error": "step_up_required",
  "reason": "AUTHENTICATION_TOO_OLD",
  "required": {
    "minimumAal": "MULTI_FACTOR",
    "maxAgeSeconds": 600,
    "acrValues": ["urn:example:aal:2"]
  },
  "correlationId": "corr-019b"
}

public record SecurityAuditEvent(
        String eventId,
        Instant occurredAt,
        String tenantId,
        String initiatingActorId,
        String effectiveSubjectId,
        String clientId,
        String action,
        String resourceType,
        String resourceId,
        String decision,
        String reasonCode,
        String policyId,
        String policyVersion,
        IdentityAssuranceLevel ial,
        AuthenticatorAssuranceLevel aal,
        FederationAssuranceLevel fal,
        Instant authenticatedAt,
        String acr,
        Set<String> amr,
        String correlationId
) {}

For sanction approval S-123, who approved it, under which tenant,
using what authentication strength, how fresh was authentication,
was this delegated/impersonated, and which policy version allowed it?

@Test
void highRiskActionRequiresFreshMfa() {
    AuthenticationEventContext auth = new AuthenticationEventContext(
            "user-123",
            "https://idp.example.com",
            "case-ui",
            Instant.now().minus(Duration.ofHours(2)),
            IdentityAssuranceLevel.VERIFIED,
            AuthenticatorAssuranceLevel.MULTI_FACTOR,
            FederationAssuranceLevel.MANAGED_FEDERATION,
            Set.of("pwd", "otp"),
            "urn:example:aal:2",
            "pwd otp",
            false,
            "sid-1"
    );

    AssuranceDecision decision = evaluator.evaluate(
            auth,
            AssuranceRequirement.highRiskDecision(),
            Instant.now()
    );

    assertThat(decision).isInstanceOf(AssuranceDecision.StepUpRequired.class);
    AssuranceDecision.StepUpRequired stepUp = (AssuranceDecision.StepUpRequired) decision;
    assertThat(stepUp.reasonCode()).isEqualTo("AUTHENTICATION_TOO_OLD");
}

@Test
void lowIdentityProofingDeniesHighRiskAction() {
    AuthenticationEventContext auth = authContextBuilder()
            .ial(IdentityAssuranceLevel.SELF_ASSERTED)
            .aal(AuthenticatorAssuranceLevel.PHISHING_RESISTANT)
            .fal(FederationAssuranceLevel.MANAGED_FEDERATION)
            .authenticatedAt(Instant.now())
            .build();

    AssuranceDecision decision = evaluator.evaluate(
            auth,
            AssuranceRequirement.highRiskDecision(),
            Instant.now()
    );

    assertThat(decision).isInstanceOf(AssuranceDecision.Denied.class);
    assertThat(((AssuranceDecision.Denied) decision).reasonCode()).isEqualTo("IAL_TOO_LOW");
}

@Test
void approveCaseReturnsStepUpRequiredWhenMfaTooOld() throws Exception {
    String token = jwt()
            .subject("approver-1")
            .tenant("tenant-a")
            .scope("case:approve")
            .acr("urn:example:aal:2")
            .authTime(Instant.now().minus(Duration.ofHours(1)))
            .build();

    mvc.perform(post("/cases/case-123/approve")
                    .header("Authorization", "Bearer " + token)
                    .contentType(MediaType.APPLICATION_JSON)
                    .content("{\"reason\":\"complete review\"}"))
            .andExpect(status().isForbidden())
            .andExpect(jsonPath("$.error").value("step_up_required"))
            .andExpect(jsonPath("$.required.minimumAal").value("MULTI_FACTOR"));
}

@Test
void approvalAuditIncludesAssuranceEvidence() {
    SecurityAuditEvent event = auditEvents.last();

    assertThat(event.action()).isEqualTo("case.approve");
    assertThat(event.aal()).isEqualTo(AuthenticatorAssuranceLevel.MULTI_FACTOR);
    assertThat(event.ial()).isEqualTo(IdentityAssuranceLevel.VERIFIED);
    assertThat(event.authenticatedAt()).isNotNull();
    assertThat(event.policyVersion()).isNotBlank();
}

assurance.step_up.required.count{action="case.approve", reason="AUTHENTICATION_TOO_OLD"}
assurance.denied.count{reason="IAL_TOO_LOW"}
assurance.denied.count{reason="FAL_TOO_LOW"}
assurance.mapping.unknown_acr.count{issuer="..."}
account.recovery.completed.count{account_type="tenant_admin"}
privileged.action.count{aal="PHISHING_RESISTANT"}

mfa_enabled = true

authentication event used method X at time T with assurance level Y,
and high-risk action requires level Z within duration D.

if ("mfa".equals(jwt.getClaimAsString("acr"))) allow();

AAL = assuranceMapping.forIssuer(jwt.getIssuer()).mapAcr(jwt.getClaimAsString("acr"));

user.assuranceLevel = HIGH

account IAL = VERIFIED
current session AAL = MULTI_FACTOR
authenticatedAt = 2026-06-28T10:01:00Z
federation trust = MANAGED_FEDERATION

Hide approve button unless MFA recent.

Backend policy returns step_up_required or deny regardless of UI behavior.

ADMIN-001: Platform signing key rotation requires phishing-resistant authentication within 5 minutes and records operator, approver, reason, key ID, and correlation ID.

1. view own profile
2. update own email
3. view assigned enforcement case
4. export case evidence
5. assign case to investigator
6. submit sanction recommendation
7. approve sanction
8. grant tenant admin
9. register OAuth client
10. rotate signing key