ADR-0004: Five authorization concerns, federated evaluation, no central authorization server¶
- Status: accepted
- Date: 2026-08-24 (updated 2026-11-02)
- Satisfies: D-01, S05, P-01
- Deliberation: Reference architecture v0.6.2, decision 5 (archived and unpublished), Q-02, Q-10, F-02
- Implemented in: fsc-infra/docker-compose.yml (concerns ① ②), services/openftv-pdp and policies/gbo (concerns ③ ④ ⑤)
Context and problem statement¶
The question "May this request proceed" splits into five questions. Each question changes at its own rate and has its own decision makers:
- organization identity
- organization permission
- access basis
- data scope
- request validity
A central authorization server couples all five questions and is a single choke point.
Decision¶
GBO evaluates each concern where it belongs, federated per organization:
- mTLS and PKI answer identity at every connection.
- The FSC Manager of the provider answers permission when it issues a token. Contract acceptance itself is a policy decision (ADR-0015).
- The PDP at the Inway of the provider answers access basis, data scope, and request validity for each request.
There is no central authorization server. An FSC access token never contains consent. Instead, the consumer presents a consent proof, and the PDP verifies it for each request (ADR-0032). The regime follows from the evidence that the request carries (ADR-0031).
For legal-basis routes (Gov-to-Gov), the design evaluates the legal basis (grondslag) locally from policy data, without a PIP call. The demo does not implement this path. The path needs its own positive evidence, because a declared flow is not sufficient (ADR-0031). For more information, see Risks and technical debt.
Consequences¶
- A revocation takes effect on the next request. No token needs to be invalidated.
- In the consent regime, each request depends on two network calls:
- the consent status, asked over FSC and never cached
- the JWKS of the register, cached for five minutes
- Concern ② also has a part at request time for integrators. A delegated call needs a mandate in the admission register (ADR-0034).
- For the mapping of the concerns to the components, see Authorization.
- The demo does not implement rate limiting (part of concern ⑤). Risks and technical debt tracks this gap.