SFS C / SF 4

Back to SFS C

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are authorization controls validated for each API operation to restrict access to permitted actions by authenticated client systems throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented evidence confirming authorization validation per operation

Assessment criterion and evidence

Actor: Organization API services and client systems. Scope: All organization-owned API endpoints. Evidence period: Throughout the review period. Required evidence: Configuration records showing operation-level authorization rules; Test results verifying enforcement. Negative criterion: Absence of operation-level authorization validation. Missing evidence: Pending verification until evidence is provided

View the JSON record (opens in a new tab).

Assessment result: unset.