A normalization layer turns heterogeneous authorization signals into trustworthy, consistent context. It collects data from systems such as HR, Finance, device management, and operational services; maps source fields into a shared schema; and assembles principals, resources, relationships, and contextual signals for policy evaluation. section 12.6.1
Shared normalization prevents equivalent policies from behaving differently across applications. It defines freshness, provenance, authenticity, encryption, signing, and verification rules while limiting each policy request to the attributes it needs. section 12.6.1 section 12.6.2
Translating source vocabulary
An HR system may mark an employee as "enabled" while policies expect "active." The normalization layer converts that source value and exposes employmentStatus consistently to every policy decision point. section 12.6.1 section 12.2
function normalizeEmployee(rawHrRecord) {
return {
id: rawHrRecord.employee_id,
employmentStatus:
rawHrRecord.status === "enabled" ? "active" : "inactive",
department: rawHrRecord.org_unit,
managerId: rawHrRecord.manager_id
};
}
This mapping illustrates how a normalization function translates source-specific field names and values into the schema used by authorization policies. section 12.6.1
