Authority Model

Authority Model | Corevexa Docs

Authority Model
Who Can Approve What

Authority mapping turns “who is allowed” into an enforceable system primitive. The authority model defines roles, approval requirements, escalation routes, and override constraints based on risk band and action class.

Role-based approvals Multi-sig for critical No silent overrides
Contract: approvals are required before execution. Overrides are approvals with a higher bar and explicit audit markings.

Authority Principles

Authority must be explicit, enforceable, and auditable. Social assumptions are not governance. Layer-7 encodes authority so systems can route decisions correctly and deny when authority is absent.

Explicit routing

Every risky action maps to a required approver role set with signature counts.

Least privilege

Roles can approve only within scoped domains. Privilege is not universal.

Audit integrity

Approvals and overrides are recorded in the decision ledger with actor identity and intent.

Default deny: if the router cannot determine the required authority path, execution is not permitted.

Role Levels (Reference)

Roles are organized by control scope. Implementations can rename roles, but must keep clear separation between operational approval and executive exception authority.

Level Role (example) Scope Typical approvals
L1 Operator Routine, low-risk actions Read access, non-sensitive tasks
L2 Supervisor Team-level scope Medium risk writes, limited changes
L3 Manager Department scope High-risk actions in defined domain
L4 Security / Compliance Officer Cross-domain governance High/critical security, data, infra actions
L5 Executive Approver Exception authority Critical actions, emergency exceptions
Policy can enforce that some action classes always require L4 co-sign regardless of other approvals.

Signatures & Verification

Approvals must be verifiable. In production, signatures should be tied to identity (JWT claims, mTLS identity, or signed payloads). Every approval includes an intent string to prevent ambiguous “rubber stamp” approvals.

Approval record

{ “decision_id”: “dec_*”, “actor”: { “id”: “user_*”, “role”: “manager” }, “intent”: “Approve deployment to production”, “method”: “jwt|mtls|signed_payload”, “signature_ref”: “sig_*”, “at”: “ISO-8601” }

Verification rules

  • Identity must be authenticated (no anonymous approvals).
  • Role must match required route for this decision.
  • Signature must be unique per actor per decision.
  • Approvals must be logged before execution is allowed.
If approval verification fails, the correct response is reject and keep the decision pending.

Mapping Tables (Risk Band × Action Class)

These tables are the practical “router.” They map decisions to required roles and signature counts. Adjust per organization, but keep the pattern: risk increases → approvals strengthen.

Core action classes

Action class Low Medium High Critical
read_public None None L2 (1) L3 (1) + L4 (1)
read_sensitive L2 (1) L3 (1) L3 (1) + L4 (1) L4 (1) + L5 (1)
write_data L2 (1) L3 (1) L3 (1) + L4 (1) L4 (1) + L5 (1)
deploy_code L3 (1) L3 (1) + L4 (1) L4 (1) + L3 (1) L4 (1) + L5 (1) multi-sig
transfer_funds L3 (1) L3 (1) + L4 (1) L3 (1) + L4 (1) L4 (1) + L5 (1) multi-sig
rotate_credentials L3 (1) L4 (1) L4 (1) + L3 (1) L4 (1) + L5 (1) multi-sig
You can require cross-functional dual control by policy (e.g., security co-sign for PII writes) regardless of risk band.

Escalation Routes

If required approvers are unavailable or an exception is required, escalation must be deterministic and logged. Escalation is not “asking louder.” It is an encoded routing path.

Reference escalation

  • L1 → L2: routine block / missing context
  • L2 → L3: medium-to-high risk promotion
  • L3 → L4: security/compliance involvement required
  • L4 → L5: critical actions and exceptions

Escalation constraints

  • Escalation must include reason and timeout.
  • Escalation must not weaken requirements (no “approve anyway”).
  • Escalation events must be recorded in the ledger as transitions.
If escalation cannot be completed within defined TTL, the decision expires and requires re-evaluation.

Overrides (Controlled Exception Path)

Overrides are allowed only when explicitly permitted by policy and only when performed by elevated authority. Overrides must be treated as special decisions with explicit markings and review requirements.

Override requirements

  • Role: L4 or L5 depending on action class
  • Reason: mandatory structured reason string
  • Scope: must be limited (time-bound and target-bound)
  • Review: post-execution review required

Override record (example)

{ “decision_id”: “dec_*”, “override”: { “actor”: { “id”: “user_*”, “role”: “security_officer” }, “reason”: “Emergency mitigation – service outage”, “expires_at”: “ISO-8601”, “scope”: { “target_id”: “svc_31”, “action_class”: “deploy_code” } } }
Non-negotiable: overrides are never silent. They must be obvious in the ledger and mandatory in reporting.