Decision infrastructure is the shared set of services, policy mechanisms, contextual signals, and governance practices used to evaluate, explain, and control authorization decisions. It becomes necessary when a decision surface—the situations in which access must be evaluated—spans many applications, people, services, and changing contexts. Without it, access logic tends to diverge, visibility falls, and decisions become difficult to explain or change consistently. section 19.1 section 19.10
Figure 19.1 Decision surface and decision infrastructure. As systems grow, the decision surface, the set of situations where access must be evaluated, expands faster than the infrastructure that governs those decisions. This gap creates authorization pressure: the growing difficulty of making decisions consistently, explaining outcomes, and maintaining control. Incremental architectural investments can close this gap, enabling organizations to manage trust reliably as complexity grows.
Use the figure to compare growth in authorization situations with the capacity to govern them. The gap is authorization pressure: difficulty making consistent, explainable, controlled decisions as systems scale. section 19.1
A practical design externalizes a coherent policy domain from application code into a common policy decision layer. Applications then rely on shared evaluation rather than each embedding its own rules. Product policies can reflect business goals while common services coordinate evaluation across systems. This does not require one authorization model: roles, relationships, attributes, and delegation can combine where each fits the access problem. section 19.2 section 19.10
Decision infrastructure accumulates through connected capabilities:
- Shared policy services and a common policy language reduce duplicated logic and make evaluation consistent across systems. section 19.10 section 19.6
- Relationship-based and attribute-based controls handle controlled sharing and access requirements that static roles cannot fulfill. section 19.2
- Contextual signals support runtime decisions, but their ownership, freshness, and assurance need governance. section 19.2 section 19.6
- Decision logs and analysis make outcomes observable, helping teams understand and improve authorization behavior. section 19.10
- Explicit, bounded delegation governs authority as automation and agents act over time. section 19.7
Table 19.1 Incremental steps toward strategic authorization. Organizations can enhance authorization capabilities by making targeted changes to address immediate challenges. Each step builds on existing practices, gradually strengthening decision infrastructure and governance without requiring a complete overhaul.
| If you are here |
You’re likely seeing |
A practical next step |
|---|---|---|
| Authorization logic embedded in applications |
Inconsistent behavior across systems; hard-to-change rules |
Externalize one high-value decision into a shared policy service. |
| Multiple policy mechanisms across teams |
Duplicate logic; outcomes that are difficult to reason about |
Standardize on a common policy model and evaluation approach. |
| Growing use of contextual signals |
Ad hoc use of attributes; unclear trust in signals |
Define ownership, freshness, and assurance requirements for key signals. |
| Increasing delegation (partners, automation, agents) |
Workarounds, over-permissioning; manual approvals |
Introduce explicit delegation models with bounded scope. |
| Policy decisions difficult to explain or audit |
Support escalations; compliance friction |
Capture and analyze decision logs to improve visibility and confidence. |
| Policy changes risky or slow |
Fear of breaking behavior; heavy review processes |
Introduce testing, simulation, and staged rollout for policy changes. |
| Organization recognizes authorization as strategic |
Cross-team alignment; executive interest |
Establish shared ownership between product, identity, and security teams. |
Use the table to select a modest next move: externalize a high-value decision, standardize evaluation, or govern important signals rather than redesigning everything at once. section 19.6
Starting with embedded document-sharing rules
If document-sharing decisions are embedded separately in several applications, move that coherent domain into shared policies and evaluate it through a common service. This reduces inconsistent behavior and creates a place to observe outcomes. Next, standardize evaluation and define assurance expectations for any contextual signals that influence sharing decisions. section 19.6 section 19.2
Treat the infrastructure as an evolving operational capability, not a one-time replacement project. As systems become distributed and automated, authorization must adapt at runtime, remain explainable, and govern authority deliberately. Incremental architectural and governance choices strengthen the ability to manage trust as complexity grows. section 19.10 section 19.7
