Secondary Authorization Management System for IT Service Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managed computer systems face challenges in ensuring business continuity due to risks from malicious and inadvertent actions by users with access rights, requiring dynamic and instantaneous authorization mechanisms to mitigate threats and ensure proper resource management.
Innovation Solution
A secondary authorization management system is implemented to determine if additional authorization is needed for service requests, involving a secondary authorization request process that includes context-based evaluation, use of knowledge systems, and potential human intervention, ensuring that only authorized requests are executed, and that post-authorization conditions are met.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic secondary authorization is implemented for service requests, then security and risk mitigation are improved, but system complexity and processing time increase
Solution Approach 1:
The authorization process is segmented into primary authorization (initial access rights) and secondary authorization (dynamic contextual approval). This segmentation allows the system to maintain basic security through primary authorization while adding layered security checks only when contextual conditions require them, thus improving overall security without uniformly increasing system complexity for all operations.
Solution Approach 2:
The secondary authorization mechanism dynamically adapts to contextual conditions such as user behavior patterns, system state, and risk assessments. The authorization requirements are not static but change based on real-time contextual factors, allowing the system to impose additional security measures only when and where needed, thereby improving security posture without creating rigid complexity throughout the entire system.
2Measurement precision
If contextual evaluation and knowledge systems are used for authorization decisions, then authorization accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary actions by pre-establishing authorization profiles, contextual parameters, and decision rules before actual service requests occur. Knowledge systems are pre-populated with organizational policies, user role definitions, and risk criteria. This preliminary preparation enables faster real-time authorization decisions by reducing the computational burden during actual service request processing.
Solution Approach 2:
The authorization system incorporates self-service capabilities through automated contextual evaluation and decision-making algorithms. The knowledge systems automatically assess contextual conditions and make authorization decisions without requiring manual intervention for every request. This automation improves authorization accuracy through consistent application of policies while reducing processing time by eliminating human review bottlenecks for routine decisions.
3Reliability
If secondary authorization requests are sent to external systems, then security control is improved, but system responsiveness and user experience deteriorate
Solution Approach 1:
The system applies partial action by sending secondary authorization requests to external systems only when contextual conditions warrant additional security verification. Not all service requests trigger external authorization checks - only those that meet specific risk criteria or contextual thresholds. This selective approach maintains strong security control for high-risk operations while preserving system responsiveness for routine, low-risk service requests.
4Productivity
If automated secondary authorization is implemented, then productivity is improved, but the need for human intervention in complex cases increases
Solution Approach 1:
The automated secondary authorization system incorporates self-service capabilities where the system autonomously evaluates contextual conditions, retrieves authorization profiles from knowledge systems, and makes authorization decisions without human intervention. This automation dramatically improves productivity by processing service requests without manual approval bottlenecks. However, the system is designed to escalate to human intervention only when contextual complexity or risk levels exceed automated decision thresholds, thus minimizing but not eliminating the need for human operators in complex cases.
Data Source
AI summary
A service request for a managed computer system is received and once a primary authorization for same has been given, a secondary authorization management system (SAMS) determines whether or not the service request requires secondary authorization. This determination is made according to a context of the managed computer system and an authorization profile for the received service request. If needed, the SAMS resolves the secondary authorization request and returns the resolution decision.