A naming standard assigns identifiers and policy elements consistently so systems can discover the right entity and make the right authorization decision. Poor naming can turn identity ambiguity into an incorrect denial of service. section 2.4
When a name is not enough
The TSA’s No-Fly List relied heavily on names, causing Senator Ted Kennedy to be treated as the banned individual. Stronger discovery requires choosing identifiers according to the policy need: email addresses aid recognition, employee numbers support administration, directory names aid discovery, and UUIDs reduce cross-system collisions. section 2.4 section 2.4.2
A useful naming standard balances:
- Human meaningfulness for names people must recognize, such as email addresses and usernames. section 2.4.2
- Uniqueness and non-reusability where reassignment could create conflicts or identity takeover. section 2.4.2
- Resistance to impersonation and forgery for security-sensitive names such as domain names. section 2.4.2
- Decentralization when independent systems need globally unique identifiers without central coordination. section 2.4.2
Policy naming in practice
Authorization policies should use one convention for equivalent actions and resources: replacing inconsistent forms such as editDoc and modify_document with schema-enforced names makes policies easier to review and maintain. A Cedar action such as doc:view illustrates a consistent policy vocabulary. section 10.1.5
