Cryptic Developers · Engineering notes
Start with the identity source
An application needs to know where an identity comes from and who can change its attributes. An employee record, a customer enrolment process and a service account have different evidence and ownership. Document these differences before choosing the sign-in interface.
Separate the decisions
Identity proofing establishes evidence about an applicant. Authentication demonstrates control of an authenticator. Authorisation decides whether an actor may perform a particular operation. NIST's identity model separates proofing, authentication and federation; applications still need their own access decisions.
Design the end of access
Role changes, departures and compromised credentials are normal lifecycle events. A review should follow a revoked entitlement through downstream systems and cached sessions. Ask who owns the decision, how quickly it takes effect and what evidence confirms removal.
Make failure understandable
Recovery, expired sessions and denied requests are part of the experience. Give users a clear next step while keeping permission checks server-side. A polished sign-in page cannot compensate for an application that fails to check access to an individual record.