SRS-084 Role-Based Access Control (RBAC) with Least Privilege Principle to restrict users to essential functions.
Identifier
SRS-084
Software System
- API Gateway
- Orchestrator
- Processors
Category
- Security
Description
Authorization mechanisms must be enforced for "all users" — this refers to any entity interacting with the system. It is needed to enforce role-based or attribute-based access control not just for human logins but also for inter-service communications. For example:
- Ensuring that a microservice with a “report builder” role can only access the endpoints and data it is authorized to handle.
- Preventing a compromised or otherwise unauthorized service from bypassing standard user authorization flows.
Derived from PRS
PRS-9F2: Cybersecurity & continuous threat detection