authorization-policy-governance-pack

authorization-policy-governance-pack is an SSOT Registry pack for authorization policy, OAuth scopes, access-token validation, permissions, entitlements, RBAC, ABAC, PBAC, ReBAC, PDP/PEP/PIP/PAP architecture, policy gateways, Cedar, OPA/Rego, XACML vocabulary, and authorization evidence.

It governs how a repository answers: can this subject perform this action on this resource in this context? Authentication facts and token claims can feed that answer, but they are not the answer by themselves.

What Is An SSOT Registry Pack?

An SSOT Registry pack is an installable package of governed Architecture Decision Records (ADRs) and Specifications (SPECs) for ssot-registry. The pack supplies reusable decision and requirement documents that downstream repositories can synchronize into their local .ssot registry and link to features, tests, claims, evidence, and releases.

Why This Pack Exists

Authorization governance fails when scopes, claims, roles, groups, entitlements, relationships, and policy decisions are treated as interchangeable. This pack separates delegated grants from runtime permissions and makes PDP/PEP boundaries, policy inputs, deny paths, and release evidence explicit.

This pack helps teams:

• distinguish scopes, claims, permissions, roles, entitlements, and policy decisions
• govern RBAC, ABAC, PBAC, ReBAC, XACML, Cedar, OPA/Rego, OpenFGA, and custom policy engines
• declare PDP, PEP, PIP, PAP, and policy gateway responsibilities
• test least privilege, deny paths, stale attributes, revoked entitlements, and tenant isolation

Pack Metadata

• Pack ID: pack:authorization-policy
• PyPI package: authorization-policy-governance-pack
• Import package: authorization_policy_governance_pack
• GitHub repository: groupsum/authorization-policy-governance-pack
• Reservation owner: extension-pack:authorization-policy-governance-pack

Domain Focus

• OAuth scopes, consent, grants, and access-token validation
• permission taxonomy and runtime permission checks
• roles, groups, and entitlements as authorization inputs
• RBAC, ABAC, PBAC, ReBAC, ACL, and capability-style modeling
• PDP, PEP, PIP, PAP, policy gateways, and app-level enforcement
• Cedar, OPA/Rego, XACML vocabulary, OpenFGA, and custom policy engines
• authorization audit, least privilege, deny-path evidence, cache behavior, and failure modes

Authority Sources

• OAuth 2.0 Authorization Framework, RFC 6749
• OAuth 2.0 Token Introspection, RFC 7662
• OAuth 2.0 Token Exchange, RFC 8693
• JWT Profile for OAuth 2.0 Access Tokens, RFC 9068
• OAuth 2.0 Security Best Current Practice, RFC 9700
• NIST SP 800-162: Guide to Attribute Based Access Control
• NIST SP 800-207: Zero Trust Architecture
• NIST SP 800-207A: Zero Trust Architecture Model for Access Control
• OASIS XACML 3.0 Core Specification
• NIST RBAC Standards
• Cedar Policy Language
• Open Policy Agent Rego Policy Language
• Google Zanzibar paper
• OpenFGA authorization modeling

Included ADRs And SPECs

This release includes 14 ADR templates and 19 SPEC templates covering authorization boundaries, OAuth scopes, access-token validation, permissions, entitlements, RBAC, ABAC, PBAC, ReBAC, PDP/PEP/PIP/PAP, policy-as-code, Cedar, OPA/Rego, XACML vocabulary, policy gateways, audit evidence, least privilege, token-to-policy mapping, and authorization failure modes.

Install With uv

uv add authorization-policy-governance-pack
uv add ssot-registry authorization-policy-governance-pack
uvx --from ssot-registry --with authorization-policy-governance-pack ssot --help

Use With The SSOT Registry CLI

uv run ssot pack inspect authorization_policy_governance_pack
uv run ssot pack preflight . authorization_policy_governance_pack --all
uv run ssot pack sync . authorization_policy_governance_pack --all --trust --yes
uv run ssot validate .
uv run ssot spec get . --id spc:pack.authorization-policy.authorization-boundary-contract

Programmatic Usage

from authorization_policy_governance_pack import load_document_manifest, read_packaged_document_text

adr_manifest = load_document_manifest("adr")
spec_manifest = load_document_manifest("spec")
text = read_packaged_document_text("spec", "SPEC-2000-authorization-boundary-contract.yaml")

Resources

• GitHub repository: groupsum/authorization-policy-governance-pack
• PyPI package: authorization-policy-governance-pack
• SSOT Registry: ssot-registry
• SSOT pack contracts: ssot-pack-contracts