How deeply does Authorization in Action cover deny-overrides?

Explains forbid, permit, and default-deny evaluation rules, plus safety and order-independence consequences.

Deny-overrides

Deny-overrides is a policy-combining rule in which any applicable deny result takes precedence over permit results.

A company may allow engineers to deploy from managed devices during on-call periods, while a universal rule blocks access from non-managed devices. Deny-overrides makes that safety rule decisive: any applicable deny defeats every permit. section 7.0 section 7.3.3

Deny-overrides is a policy-combining rule used by Cedar. After individual policies are filtered and evaluated, one applicable forbid produces Deny, even when permit policies also match. section 7.3.3

The decision sequence is:

An applicable forbid evaluates to true: return Deny. section 7.3.3
No forbid applies, but an applicable permit evaluates to true: return Allow. section 7.3.3
No applicable permit succeeds: return Deny by default. section 7.3.3

Managed-device guardrail

A permit allows deployment when an engineer is on call or within business hours. A forbid blocks every request from a non-managed device. A non-managed device therefore receives Deny regardless of the permit. section 7.0 section 7.3.3

How Authorization in Action covers it

liveBook manning.com

Read Authorization in Action on liveBook Get the book at manning.com

Related concepts

deny-by-defaultproduces · Deny-by-default is an authorization technique in which access is denied unless an applicable access-control rule explicitly permits it.
Cedarused by · Cedar is an open-source declarative policy language and evaluation engine for expressing and evaluating fine-grained authorization and access-control policies.
permit policyuses · A permit policy is an authorization policy whose applicable true evaluation grants access unless an overriding forbid policy applies.
forbid policyuses · An authorization policy whose effect denies access when its stated requirements are satisfied or a matching prohibition applies.

This explainer was generated by Manning's knowledge graph from the text of Authorization in Action. The section links point to the parts of the book it draws on.