15% weight · Owner: Security Architecture
Security and role-aware authorization
Validates authentication, actor/subject context, object-level access, delegation, and policy-as-code.
GREEN≥ 90%
AMBER≥ 70%
REDBelow threshold or blocker
| Gate | Requirement | Severity | Blocking | Evaluator | Evidence path |
|---|---|---|---|---|---|
SEC-001 | Authentication is configured | CRITICAL | Yes | nonempty | security.authentication |
SEC-002 | Object-level authorization is required | CRITICAL | Yes | truthy | security.object_level_authorization |
SEC-003 | Actor/subject model is defined | HIGH | No | truthy | security.actor_subject_model |
SEC-004 | Policy-as-code is enabled | HIGH | No | truthy | security.policy_as_code |
SEC-005 | Acting modes are declared | HIGH | No | truthy | security.acting_modes |
SEC-006 | OpenAPI declares security requirements | CRITICAL | Yes | openapi_security | Derived evidence |