Access Control
5 requirements
·
8 scenarios
Authentication Gate
JR-access-control-001
All API requests SHALL be authenticated. Unauthenticated requests SHALL be rejected before any processing begins.
1 test scenario
- Unauthenticated request is rejected JR-access-control-001.1
Granular Access Configuration
JR-access-control-002
Access SHALL be determined by the access control list. Email-specific configuration SHALL take precedence over domain-level configuration when both are present.
2 test scenarios
- Email-specific rule overrides domain rule JR-access-control-002.1
- Domain rule applies when no email override exists JR-access-control-002.2
Tiered Access Levels
JR-access-control-003
Two access levels SHALL be supported: a basic tier with a limited tool set and a full tier with all tools available. The assigned tier governs which workflows and tools are available to a given domain or user.
2 test scenarios
- Basic tier blocks restricted tools JR-access-control-003.1
- Full tier enables all tools JR-access-control-003.2
Defense-in-Depth Authorization
JR-access-control-004
The email channel SHALL apply authorization at two sequential gates: a sender validation gate that rejects senders not on the allowlist and an authorization gate that verifies tool-level permissions before routing.
2 test scenarios
- Sender validation gate rejects unknown sender JR-access-control-004.1
- Authorization gate blocks unauthorized tool use JR-access-control-004.2
Access Decision Audit Trail
JR-access-control-005
All access decisions SHALL be logged with sender identity, domain, decision outcome, and the gate at which the decision was made.
1 test scenario
- Denied access is logged with full context JR-access-control-005.1