top of page
A04
Agent Identity & Authorisation
Where an agent acts on behalf of a person, the delegating principal and the scope of delegation are recorded and carried through to downstream calls.
WHAT IT ADDRESSES
Confused deputy; no accountable human behind an action.
VERIFICATION METHOD
Trace a downstream system call and confirm the principal is resolvable.
NIST NCCoE; OWASP T&M
bottom of page