An architecture decision record (ADR) is a short, version-controlled document that captures the context, alternatives, chosen decision, consequences, and related artifacts behind an architectural or authorization choice. Linking each policy to its ADR makes the path from organizational intent to deployed behavior traceable. section 14.2 section 14.9
Use ADRs to make authorization governance explainable and reviewable:
- Record why a policy exists, which alternatives were considered, and what consequences the choice creates. section 14.2
- Reference the ADR identifier from the policy so reviewers, auditors, and engineers can connect policy logic with its rationale. section 14.2
- Attach regulatory controls, metadata, version history, test results, and decision logs to create inspectable compliance evidence. section 14.5
- Start with ADRs when policy engines or identity governance systems are absent, then add ownership, peer review, and version control. section 14.7
Tracing a personal-data access policy
A GDPR-related policy can require an approved purpose and tenant-scoped justification before granting access to personal data. Its ADR records the context and decision; its metadata identifies the regulatory control; CI/CD tests the rule before deployment; version history and decision logs preserve review and runtime evidence. If an incident occurs, engineers can link the incident to the policy and ADR to compare documented intent, policy logic, and behavior. section 14.5
Figure 14.2 The policy management life cycle. Policies go through distinct stages (creation, review and approval, deployment and use, monitoring, and eventually retirement) with updates feeding back into the review process. The life cycle ensures that authorization policies remain current, coherent, and aligned with organizational intent.
The policy management life cycle shows where ADR-backed decisions fit: creation, review and approval, deployment, monitoring, updating, and retirement. section 14.2
