coulomb/info-tech-canon
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
info-tech-canon/infospace/assimilation/canon-federation/source/research/authorization-relationships/cedar-principal-action-resource-context.md
tegwick 372f671eef
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Distribute frozen federation corpus by concept destination 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a070b5-4994-7271-bd8b-7c3dbcedec4b
2026-09-06 00:44:37 +02:00

4.7 KiB
Raw Blame History

Cedar Principal Action Resource Context

Source Type

Standard and product reference. Cedar policy language (AWS Verified Permissions) with principal-action-resource-context evaluation model.

Domain

Fine-grained authorization, policy-based access control, and ABAC/RBAC hybrid evaluation.

Why This Source Matters

Cedar's principal-action-resource-context distinction preserves orthogonality between identity, action, resource, and request context.

Key Concepts

  • Principal: entity requesting access; typed entity reference (User::"alice", Role::"admin").
  • Action: operation being attempted (Action::"view", Action::"delete").
  • Resource: entity being accessed (Document::"report").
  • Context: request-time record with additional attributes (IP, time, delegated-by).
  • Policy: Cedar statement allowing or forbidding (principal, action, resource) under conditions.
  • Entity: typed object in entity store with attributes and parents.
  • Schema: defines entity types, actions, and attribute shapes.
  • Group / Role entity: principal may be member of groups; roles as entities.
  • Authorization request: tuple of principal, action, resource, context evaluated against policies.
  • Conditional policies: when-clauses over context and entity attributes.

Relevant Terminology

Term Source meaning
Principal Entity requesting access in authorization decision.
Action Verb/operation being authorized.
Resource Target entity of the action.
Context Ephemeral request attributes.
Entity Typed node in entity store with UID and attributes.
Policy Rule governing allow/deny.
Schema Type system for entities and actions.
Role Entity type principals can assume or belong to.
Group Entity type with membership edges.
UID Unique entity identifier string (Type::"id").

Modeling Assumptions

  • Authorization is a decision over four orthogonal dimensions (PARTICIPANT, ACTION, TARGET, CONTEXT).
  • Principals are entity references, not full identity records.
  • Entity store is separate from identity directory; may sync from IAM.
  • Roles and groups are entities, not free-floating strings.
  • Context carries delegation and environmental facts at decision time.
  • Policies are declarative and evaluated without imperative code.
  • No social or legal relationship model beyond entity parent/group links.

Identity-Canon Implications

  • Cedar Principal maps to Authorization Principal projection.
  • Resource maps to Authorization Resource projection.
  • Action maps to Authorization Action projection.
  • Context maps to request Context projection (may carry Delegation evidence).
  • Entity in store may represent Account, Group, Role, or Organization projection — not canonical Actor directly.
  • Parent/group entity links parallel Membership in authz layer.
  • Context delegatedBy or custom attributes support S11 (AI agent delegation).
  • Strong evidence for P6 and P2 (principal ≠ actor ≠ account).

Terminology Conflicts

  • Principal vs. Actor: Cedar principal is decision participant; actor is conceptual entity.
  • Principal vs. Subject: OIDC subject is identifier; Cedar principal is typed entity UID.
  • Role: Cedar Role entity vs. IAM role vs. social role.
  • Group: Cedar group entity vs. LDAP group vs. community.
  • Entity: Cedar entity vs. canon Entity family (actor layer).

Candidate Canonical Mappings

Cedar concept Candidate canonical concept
Principal Authorization Principal
Resource Authorization Resource
Action Authorization Action
Context Request context projection
Entity (User) Authorization Principal (Account projection)
Entity (Group) Group (authz projection)
Entity (Role) Role (authorization projection)
Policy Authorization Policy (downstream artifact)
Schema Authorization schema (downstream)
parent relation Membership/inheritance (authz projection)
Context.delegatedBy Delegation Relationship (context reference)

Open Questions

  • Should canon define a minimal Context projection schema for delegation and assurance attributes?
  • How should Cedar User entities map to Account vs. Service Account vs. Artificial Agent?
  • Are Cedar Role entities always authorization projections, or can they mirror canonical Role relationships?
  • Should entity UID format be standardized in downstream recommendations?

References