Skip to content

Improve RBAC policy precedence checks #1654

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
modelsbridgeaicom-ship-it wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Improve RBAC policy precedence checks #1654

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 46 additions & 0 deletions skills/identity/rbac-design/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,6 +297,44 @@ RBAC-ABAC-05: Environment attributes (time, location, risk) not utilized
RBAC-ABAC-06: ABAC policies not testable — no simulation or dry-run capability
RBAC-ABAC-07: Policy conflicts not detected — overlapping permit/deny without resolution order
RBAC-ABAC-08: Obligations (logging, notification) not enforced by PEP
RBAC-ABAC-09: Policy combining algorithm not documented
RBAC-ABAC-10: Deny exceptions can be overridden by broad permit rules
RBAC-ABAC-11: PDP or PEP fails open when required attributes are missing, stale, or unavailable
RBAC-ABAC-12: No negative test cases proving conflicting policies resolve to the expected deny decision
```

#### Policy Precedence and Conflict Resolution

Hybrid RBAC/ABAC systems often combine coarse-grained roles with fine-grained
attribute conditions. The design must state how conflicts are resolved before a
policy can be considered auditable.

Require the authorization design to document:

- **Combining algorithm:** deny-overrides, permit-overrides, first-applicable, priority-based, or explicit custom logic.
- **Default decision:** unmatched requests and missing attributes must resolve to deny unless a documented exception exists.
- **Deny precedence:** emergency blocks, legal holds, account suspension, tenant isolation, and data-classification deny rules should not be bypassed by broad role grants.
- **Failure mode:** PDP, PIP, or attribute lookup failures must fail closed for sensitive operations.
- **Conflict tests:** policy simulation must include positive and negative cases for overlapping permit and deny rules.

**Example conflict test set:**

| Scenario | Expected Decision | Evidence Required |
|---|---|---|
| User has `finance-reader` role but account status is `suspended` | Deny | Simulator output showing suspension deny overrides role permit |
| User has tenant admin role for tenant A and requests tenant B data | Deny | Test proves tenant boundary condition overrides admin role |
| Required `device_compliance` attribute is unavailable | Deny | PDP/PEP log showing fail-closed behavior |
| Break-glass role is activated without ticket or expiry | Deny | Policy test showing prerequisite obligation is enforced |

**What to look for:**

```
RBAC-PREC-01: No documented policy combining algorithm
RBAC-PREC-02: Broad role permits override tenant, suspension, or data-classification denies
RBAC-PREC-03: Missing attributes produce permit decisions for sensitive resources
RBAC-PREC-04: First-match policy ordering can be changed without review or test evidence
RBAC-PREC-05: Conflict tests cover only happy-path permits, not deny precedence
RBAC-PREC-06: Break-glass or emergency access bypasses obligations without time-bound approval
```

---
Expand Down Expand Up @@ -387,6 +425,7 @@ RBAC-MINE-06: Mining does not account for SoD constraints (mined roles may creat
- Constraints (Step 3): [count]
- Permission Boundaries (Step 4): [count]
- ABAC Policies (Step 5): [count]
- Policy Precedence / Conflict Resolution: [count]
- Role Mining (Step 6): [count]

### Detailed Findings
Expand All @@ -395,6 +434,11 @@ RBAC-MINE-06: Mining does not account for SoD constraints (mined roles may creat
### Design Recommendations
[Architecture diagram or pattern with framework justification]

### Policy Conflict Test Evidence
| Test Case | Conflicting Rules | Expected Decision | Actual Decision | Pass/Fail |
|---|---|---|---|---|
| [name] | [permit rule vs deny rule] | [Permit/Deny] | [Permit/Deny] | [Pass/Fail] |

### Remediation Roadmap
[Phased implementation plan]
```
Expand Down Expand Up @@ -437,6 +481,8 @@ RBAC-MINE-06: Mining does not account for SoD constraints (mined roles may creat
6. **Role mining without business validation** — clustering users by access patterns may replicate existing privilege creep rather than correct it.
7. **Choosing RBAC vs. ABAC as binary** — most environments need both. RBAC for structural, ABAC for contextual. Hybrid is the norm.

8. **Leaving policy precedence implicit.** If the PDP, gateway, and application code resolve conflicts differently, a deny rule can be silently bypassed by a broad permit. Require a documented combining algorithm and negative tests for every high-risk deny rule.

---

## Prompt Injection Safety Notice
Expand Down