AC-24 asks that your chosen access control decisions are applied to each access request before access enforcement happens. The organization fills in the specific decision information to apply.
800-53 binds federal systems and, by contract, some suppliers. For other teams, it is a useful lens on how authorization works across services.
What it means in practice
The guidance draws a line. A decision is when authorization information meets a specific request. Enforcement is when the system acts on that decision. They are often the same component, but they do not have to be, and in distributed systems they often are not.
Think of an API gateway that enforces and a policy service that decides. AC-24 wants you to know which one decides, and to make sure the decision comes first.
The enhancements are AC-24.1 Transmit Access Authorization Information and AC-24.2 No User or Process Identity.
Evidence to collect
- An architecture diagram showing where decisions and enforcement happen.
- The decision inputs you require, such as role, resource and context.
- A test or log showing a request denied by the decision point.
Common gaps
- Enforcement that trusts a cached or stale decision.
- Services that skip the decision point on internal calls.
How to implement it
Centralize decisions where you can, and make every enforcement point call them. Log each decision with its inputs.
Quick check
How is a decision different from enforcement?
A decision applies authorization information to a request. Enforcement is the system acting on that outcome.
Sources
- NIST SP 800-53 Rev 5, AC-24: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-24
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
