An authorization response is the result of evaluating an authorization request: it typically returns allow or deny and may include metadata explaining the decision or identifying determining policies. section 4.3.2
A time-sensitive entitlement decision
Carl’s roles remain unchanged, but at 11 p.m. a policy removes sensitive entitlements. His response effectively permits reading customer records and updating ticket status; at 9 a.m., those entitlements return. section 4.3.2
Figure 4.1 Relationships among key authorization terms. Principals, actions, and resources form the core of access decisions and are enriched with attributes, roles, and group memberships. All entities exist within namespaces and can be either principals or resources. The diagram also shows the legacy term subject as an older equivalent of principal and illustrates how actions operate on resources based on contextual and identity-based properties.
Use the relationship diagram to connect authorization responses with principals, actions, resources, attributes, roles, groups, and contextual properties. section 4.3.2
