> can this subject perform this action on this object?
IMHO, the most elegant method to answer this question is capability based access control. If the subject can utter the action, then it can perform it. And then delegation is the transfer of nouns and verbs to perform the utterances.
> If the subject can utter the action, then it can perform it.
This sounds like another layer of weird terminology that doesn't mean anything for someone who is not familiar with whatever capability system you're thinking of.
Say I am a user who can see a particular directory on a shared setup. I try to upload a file in this directory, using the same method that worked on another directory. The question of AuthZ is: will I be allowed to do it or not? In the plain sense of the words, I can absolutely "utter the action", I have all of the "verbs" (upload) and "nouns" (the file, the destination path). Still, I should not be allowed to perform the action if I was only given read-only access here.
Now sure, you can say that "upload to dirA" is a different verb than "upload to dirB". But this is just confusing terminology, it doesn't enlighten anything.
Unclosable cookie banner. Top notch website engineering.
https://xkcd.com/927
Nice work and all regardless
turns out naming is important
I'm maintaining a document called Tricksy words with multiple meanings that cause endless confusion and strife
Just in the past year I have wasted several months pulling my hair out due to incorrectly named projects.
It really does turn out naming is important!
> can this subject perform this action on this object?
IMHO, the most elegant method to answer this question is capability based access control. If the subject can utter the action, then it can perform it. And then delegation is the transfer of nouns and verbs to perform the utterances.
> If the subject can utter the action, then it can perform it.
This sounds like another layer of weird terminology that doesn't mean anything for someone who is not familiar with whatever capability system you're thinking of.
Say I am a user who can see a particular directory on a shared setup. I try to upload a file in this directory, using the same method that worked on another directory. The question of AuthZ is: will I be allowed to do it or not? In the plain sense of the words, I can absolutely "utter the action", I have all of the "verbs" (upload) and "nouns" (the file, the destination path). Still, I should not be allowed to perform the action if I was only given read-only access here.
Now sure, you can say that "upload to dirA" is a different verb than "upload to dirB". But this is just confusing terminology, it doesn't enlighten anything.
excellent article, very thorough and nuanced explanation.
Nice!
I'd like to fix the prior abstract. Auth and auth upsets me greatly cos we have:
Authentication & Authorization
and we call both/either auth. Hence please help me make this a thing:
AuthENTIcation & AuthORIzation : ENTI & ORI
ENTI- can you enter, ORI (or ORIZ) what can you do?
This has already been solved well-enough with AuthN and AuthZ as distinct names.
ident and perms