jperezduerto.info
Security in depth · Unit 28 · Lesson 5 of 11
Design what happens when checks fail
Define a safe pending state when a document permission check is unavailable.
Helpful before thisThreat modeling: ask before building
After this lesson you can
- Distinguish a valid login, a positive permission decision, and an unavailable decision.
One idea. One situation. One reasoned decision.
Three states need three meanings
A permission check can allow, deny, or fail to produce a usable decision. Treating the third state as approval turns a dependency failure into a different access policy. For protected content, define rejection or safe deferral without releasing the content.
Read the supplied record
F1 describes a fictional document request.
| Record | Supplied fact |
|---|---|
| Login session | Valid when the request arrived |
| Document rule | Read requires a current positive permission decision |
| Permission service | Timed out without a decision |
| Offline or cached permission exception | None approved |
| Retry queue | Available for deferred work |
Assume the recorded timeout occurred before any document delivery. The record establishes identity but not permission to read this document.
A suitable design returns no protected content and makes the pending or unavailable state clear. If a retry is queued, preserve only the information needed to process it safely. Queueing is not approval, and a “completed” message would misrepresent the result.
Before later delivery, evaluate the requester’s current authority and relevant session state again. A person may have lost access while the request waited. Record the delivery outcome separately from the original timeout so operators can distinguish unresolved work from successful recovery.
This policy has an availability cost: an authorized person may need to wait. Assign an operational owner and a retry or support path instead of silently granting access during outages. A different continuity policy would require explicit design and approval; F1 contains no such exception.
The key distinction: Missing permission evidence is neither an approval nor a completed request.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which handling of F1 matches the approved document rule?
Show the answer
Correct answer: Return no document content, mark the request pending or unavailable, and recheck current permission before any later delivery. The session establishes identity, but the missing authorization decision does not grant this read. A retry needs a valid decision for its actual delivery.
Try it
- WriteWrite a three-row decision table for F1: permission allowed, denied, or unavailable. Add what a retry must recheck and what message tells the requester the actual state.