# Authorisation Pattern

> Security pattern for implementing access control and authorization. Use when designing permission systems, implementing RBAC/ABAC, preventing unauthorized access, addressing privilege escalation, or ensuring users can only perform allowed actions on permitted resources. Addresses "Entity performs disallowed action" problem.

- **Type:** Skill
- **Install:** `agentstack add skill-igbuend-grimbard-authorisation-pattern`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [igbuend](https://agentstack.voostack.com/s/igbuend)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [igbuend](https://github.com/igbuend)
- **Source:** https://github.com/igbuend/grimbard/tree/main/skills/authorisation-pattern

## Install

```sh
agentstack add skill-igbuend-grimbard-authorisation-pattern
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Authorisation Security Pattern

Ensures entities can only perform actions they are permitted to perform on resources they are permitted to access. Prevents privilege escalation and unauthorized access.

## Problem Addressed

**Entity performs disallowed action**: An unprivileged user performs actions reserved for administrators, accesses other users' data, or manipulates resources beyond their permissions.

Examples:
- User changes another customer's account details
- Unprivileged entity performs admin operations
- Attacker accesses internal documents by guessing identifiers

## Core Components

| Role | Type | Responsibility |
|------|------|----------------|
| **Subject** | Entity | Requests actions on resources |
| **System** | Entity | Manages protected resources |
| **Enforcer** | Enforcement Point | Intercepts requests, enforces decisions |
| **Decider** | Decision Point | Makes allow/deny decisions |
| **Policy Provider** | Information Point | Manages access control rules |

### Data Elements

- **action**: Operation Subject wants to perform
- **principal**: Authenticated identity of Subject
- **actionId**: Identifier for the action type
- **objectId**: Identifier for the target resource
- **privileges**: Permissions granted to principal

## Authorisation Flow

```
Subject → [action(principal)] → Enforcer
Enforcer → [authorise(principal, actionId, objectId)] → Decider
Decider → [get_privileges(principal)] → Policy Provider
Policy Provider → [privileges] → Decider
Decider → [allowed/denied] → Enforcer
Enforcer → [action] → System (if allowed)
        → [error] → Subject (if denied)
```

1. Subject (with established principal) requests action
2. Enforcer intercepts and extracts actionId, objectId
3. Decider queries Policy Provider for privileges
4. Decider evaluates request against privileges
5. If allowed: forward to System
6. If denied: return error to Subject

## Critical Considerations

### Authorise After Authentication
- Enforcer must only process authenticated requests
- Principal must be established before authorization
- Combine with Authentication pattern

### Default Deny
- Deny all requests unless explicitly allowed
- Policy should grant permissions, not revoke them
- Missing rule = denied

### Object-Level Authorization (IDOR Prevention)
**Critical**: Always check both:
1. Can principal perform this ACTION type?
2. Can principal access this specific OBJECT?

Failing to check objectId leads to Insecure Direct Object Reference (IDOR) vulnerabilities.

### Complete Mediation
- Check EVERY request
- No bypass paths
- Enforcer must be unavoidable

### Policy Integrity
- Protect policy from unauthorized modification
- Policy changes = security-sensitive operations
- Audit policy modifications

### Resource Concerns
- Enforcer/Decider on every request path
- Potential performance bottleneck
- Potential DoS target
- Consider caching, rate limiting

## Authorization Models

### Role-Based Access Control (RBAC)
```
Principal → Roles → Permissions
```
- Assign roles to users
- Assign permissions to roles
- Check if principal's roles include required permission

### Attribute-Based Access Control (ABAC)
```
if (subject.dept == resource.dept AND
    subject.clearance >= resource.classification)
    then allow
```
- Evaluate attributes of subject, resource, environment
- Flexible policy expressions

### Access Control Lists (ACL)
```
Resource → [allowed principals/operations]
```
- Per-resource permission lists
- Direct mapping of who can do what

## Implementation Checklist

- [ ] Authentication precedes authorization
- [ ] Default deny policy
- [ ] Action-level authorization check
- [ ] Object-level authorization check (IDOR prevention)
- [ ] Enforcer cannot be bypassed
- [ ] Policy protected from tampering
- [ ] Policy changes audited
- [ ] Consistent error messages (no information leakage)
- [ ] Rate limiting on authorization endpoints

## Error Handling

Return consistent errors:
- Don't reveal whether resource exists
- Don't reveal why authorization failed specifically
- Log details server-side, return generic errors to client

## Related Patterns

- Authentication (establishes principal)
- Session-based access control (combines both)
- Log entity actions (audit trail)
- Limit request rate (DoS protection)

## References

- Source: https://securitypatterns.distrinet-research.be/patterns/
- OWASP Authorization Cheat Sheet
- OWASP IDOR Prevention

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [igbuend](https://github.com/igbuend)
- **Source:** [igbuend/grimbard](https://github.com/igbuend/grimbard)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-igbuend-grimbard-authorisation-pattern
- Seller: https://agentstack.voostack.com/s/igbuend
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.