A decision surface is the total set of situations in which an authorization system must evaluate access. It grows as people, services, automation, and contextual signals such as device posture, location, and workload status participate in decisions. section 19.1
The surface can expand faster than the infrastructure governing it. That gap creates authorization pressure: difficulty making decisions consistently, explaining outcomes, and maintaining control as systems scale. section 19.1 section 19.10
Managing a growing decision surface requires:
- Moving authorization from scattered feature code into architecture and shared policy infrastructure. section 19.4
- Combining relationship-based, attribute-based, role-based, and delegation models for complex access scenarios. section 19.10
- Supporting runtime evaluation, decision visibility, governed signals, and explicit delegation as contexts change. section 19.10 section 19.7
Enterprise collaboration at scale
As employee interactions, customer collaboration, services, and automated actions spread across systems, access decisions move beyond application boundaries. A company may respond with shared policy services, relationship-based controls, and attribute-driven assurance, while still needing to explain why each decision occurred. section 19.1 section 19.4
Figure 19.1 Decision surface and decision infrastructure. As systems grow, the decision surface, the set of situations where access must be evaluated, expands faster than the infrastructure that governs those decisions. This gap creates authorization pressure: the growing difficulty of making decisions consistently, explaining outcomes, and maintaining control. Incremental architectural investments can close this gap, enabling organizations to manage trust reliably as complexity grows.
Visualizes how the decision surface can outgrow decision infrastructure and create authorization pressure. section 19.1
