A source of truth is the authoritative record from which correct attribute values are obtained. Authorization systems should keep their attribute records synchronized with it. section 2.6.3
Reliable authorization depends on keeping critical attributes accurate:
- Proof critical attributes whenever they change, because spoofed or incorrect values can undermine otherwise strong authentication and authorization. section 2.6.3
- Evaluate attributes dynamically where possible, rather than relying on long-lived credentials that may preserve outdated values. section 2.6.3
- Use systematic auditing and logging to assess whether identity and authorization systems operate as designed. section 2.6.3
Out-of-date authorization attributes
A long-lived credential can retain stale attributes, creating unauthorized access even when authentication and authorization controls are otherwise well designed. section 2.6.3
