Authorization
What actually needs to participate when this decision is made?
The systems that establish what a decision relies on don't always need to participate when that decision is made.
Krutho is building authorization infrastructure on a different decision model. The receiving system evaluates established authority where it makes the decision.
The organization governs. Each operation decides.
Krutho lets the receiving system evaluate established authority where it makes the decision.
Selected decisions depend less on systems that would otherwise have to participate synchronously.
Established elsewhere does not have to mean decided elsewhere.
The receiving system evaluates evidence against its own trust, the state available to it and the requirements of the decision.
The systems that established the authority or facts do not have to participate synchronously in every evaluation. The evidence can be a credential that proves the device holding it is present, not just that someone knows a secret.
Governed does not mean continuously supervised.
Removing one dependency does not make the decision dependency-free.
What can responsibly be decided depends on what can be known at that moment.
Evidence
What has been established?
Trust
What can the receiving domain rely on?
State
What is known about its current validity?
Requirements
What does this decision require?
What is enough to make this decision here, now?
One architecture. Different possibilities.
Keep an operation operating.
Selected decisions continue without every establishing system participating each time.
Let the relationship continue.
Crossing a system boundary does not have to mean rebuilding the relationship.
Stay in control without being present for every decision.
Authority stays governed without continuous synchronous participation.
What we have shown.
Working implementations and controlled demonstrations provide evidence for specific parts of the architecture.
Go deeper where it matters.
Why does this matter?
Explore what becomes possible through a different authorization architecture.
How does it work?
Explore authority, evidence, trust, lifecycle, evaluation, decision and enforcement.
Where can it apply?
See what the architecture makes possible in different environments.
What have we shown?
Examine working implementations and controlled demonstrations behind specific parts of the architecture.