How Do I Model Authorisation?

Model authorisation with actors, role relationships, security policy, and explicit outcomes. The source should show who participates and what boundary is governed.

Name The Actors And Roles

Actor roles let a capability distinguish the requester from the approving authority. Rules can then describe relationships between those roles.

Attach Security Policy

A security policy makes authorisation a compiler-visible requirement of the capability boundary, rather than an implementation note.

authorisation.dcl

language dcl 0.9

actor Employee is human
actor Manager is human

policy LeaveAuthorisation {
  family security
  authorization required
}

shape LeaveApprovalInput {
  requestId: Uuid required
  daysRequested: Number required
}

capability ApproveLeaveRequest {
  intent LeaveApprovalInput from Employee

  actors {
    requester: Employee
    approver: Manager
  }

  outcomes {
    ApprovalGranted
    SelfApprovalRejected
  }

  rules {
    ApproverIsDifferent:
      actors.requester is not equal to actors.approver
  }

  policies {
    LeaveAuthorisation governs capability
  }

  when {
    ApproverIsDifferent violated then SelfApprovalRejected
    otherwise then ApprovalGranted
  }
}

Open in Playground