====== OR-003c — Security Domain Resource Enforcement ======

[[dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003:start|Go to OR-003 — Classified and Unclassified Environments]]

===== Statement =====

[[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL prevent an operation from accessing a resource not authorized for the operation's governing [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domain]].

===== Derived From =====

This requirement derives from:

  * [[dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003:start|OR-003 — Classified and Unclassified Environments]]
  * Crucible System Requirements Specification, Version 1.1 Draft, Operational Requirements, OR-003

The Original Requirement states:

> //The system SHALL support classified and unclassified deployment environments.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]]

OR-003c isolates the obligation to prevent a Crucible operation from accessing a resource outside the authorization boundary of its governing Security Domain.

===== Rationale =====

A [[dido:99_annexes:annex-b-terms-and-definitions:c:classified_environment|Classified Environment]] or [[dido:99_annexes:annex-b-terms-and-definitions:u:unclassified_environment|Unclassified Environment]] can contain resources governed by different [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domains]].

Execution within an authorized environment does not by itself authorize access to every resource within that environment.

OR-003c prevents a Crucible operation from crossing the resource boundary established for its governing Security Domain.

The responsible authority establishes the Security Domain and identifies its authorized resources. Crucible enforces the established authorization.

===== Applies To =====

This requirement applies to:

  * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]]
  * Crucible operations
  * [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domains]]
  * Resources accessed by Crucible operations
  * [[dido:99_annexes:annex-b-terms-and-definitions:c:classified_environment|Classified Environments]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:u:unclassified_environment|Unclassified Environments]]

===== Verification =====

Verification confirms that:

  - Each tested Crucible operation identifies its governing [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domain]]
  - The governing Security Domain identifies the resources authorized for the tested operation
  - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] permits the tested operation to access a resource authorized for the governing Security Domain
  - Crucible prevents the tested operation from accessing a resource not authorized for the governing Security Domain
  - Crucible records each resource-access denial caused by a Security Domain restriction
  - Each denial record identifies the operation, governing Security Domain, requested resource, and denial result

===== Referenced By =====

The following pages reference this requirement:

{{backlinks>.#dido:02-crusible}}

===== Delivery Phase =====

Implemented and Verified.

===== Implementation Status =====

<todo>Assess whether the current Crucible implementation prevents each operation from accessing resources not authorized for its governing Security Domain.</todo>

===== Requirement Status =====

<todo>Review and approve OR-003c as a leaf requirement derived from OR-003.</todo>

----
===== Issues =====

<todo>Identify the authority responsible for establishing each Security Domain used by Crucible.</todo>

<todo>Define how each Crucible operation identifies its governing Security Domain.</todo>

<todo>Define how each Security Domain identifies its authorized resources.</todo>

<todo>Define the behavior required when an operation does not identify a governing Security Domain.</todo>

<todo>Define the behavior required when a requested resource does not identify an associated Security Domain.</todo>

<todo>Define the record required when Crucible denies resource access because of a Security Domain restriction.</todo>

----
===== Notes for Editors =====

This requirement page should retain the stable requirement identifier ''OR-003c''.

This page is a leaf requirement page and omits a trailing '':start'' from its namespace.

OR-003c requires enforcement of an established Security Domain resource boundary. It does not require Crucible to establish, authorize, or define a Security Domain.

The responsible authority establishes:

  * The Security Domain identifier
  * The Security Domain boundary
  * The governing security policy
  * The resources authorized within the Security Domain

Changes to the Statement should preserve:

  * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] as the responsible actor
  * Prevention as the required behavior
  * A Crucible operation as the subject of enforcement
  * A resource as the controlled object
  * The governing [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domain]] as the source of authorization

To reference this requirement Statement from another wiki page, insert:

<code dokuwiki>
{{section>dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003:or-003c#Statement&noheader&nofooter&noeditbtn}}
</code>

Do not rename this page after an external citation unless a redirect or move plan is in place.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>