Authorization

Overview

Review implemented validation rules for missing, inconsistent, or misplaced authorization enforcement.

Authorization findings highlight places where protected Cloud workflows need clear server-side access-control evidence.

Why it matters

Cloud uses this guidance to help teams interpret local validation findings in organization context without turning the docs into implementation notes.

When this domain drifts, findings become harder to triage, ownership becomes less clear, and architecture review depends too much on individual memory.

Good architectural practices

• Protected operations with visible authorization checks.
• Consistent enforcement across related resource operations.
• Authorization logic placed at reusable request or service boundaries.

Common anti-patterns

• Missing authorization enforcement
• Inconsistent authorization within resource
• Authorization logic placed in wrong layer

Relationship to other architecture areas

This domain usually overlaps with neighboring validation categories. Use the related pages below to understand the adjacent architecture concerns before changing policy, suppressing a finding, or accepting risk.

Implemented rules

These are the currently implemented rules in this category. Use this table for category-level orientation, then open the Rule Catalog when you need rule-specific examples and remediation guidance.