Authority

Go up to Terms and Definitions

Authority is the recognized right or power of an Actor to direct actions, make decisions, grant permissions, approve outcomes, or impose obligations within a defined scope.

An Actor can derive Authority from:

• A law
• A regulation
• A contract
• A charter
• An organizational structure
• A delegation
• A Policy
• A Governance Policy
• An assigned Role
• Another recognized source

Authority can include the right or power to:

• Establish Policies
• Establish Governance Policies
• Assign Roles
• Allocate Resources
• Approve Baselines
• Establish Validation Criteria
• Approve Test Definitions
• Authorize Test Execution
• Assign or approve Verdicts
• Make Validation Decisions
• Grant exceptions or waivers
• Enforce obligations
• Resolve disputes
• Delegate Authority
• Revoke delegated Authority

An Authority assignment can identify:

• The authorized Actor
• The source of Authority
• The applicable Role
• The permitted decisions and actions
• The applicable scope
• The applicable Governance Domain
• The effective time
• The expiration time
• The delegation rules
• The applicable limitations
• The applicable conditions
• The applicable Policies
• The applicable Governance Policies
• Its Provenance
• Its Traceability

recognized right or power of an Actor to direct actions, make decisions, grant permissions, approve outcomes, or impose obligations within a defined scope

Adapted from:

• Actor
• Role
• Policy
• Governance Policy
• DIDO Reference Architecture
• DIDO Reference Implementation Conceptual Model
• DIDO-TE draft Requirements Register

Authority differs from an Actor:

• An Actor identifies the participant
• Authority identifies the recognized right or power exercised by that Actor

An Actor does not possess Authority merely because the Actor can technically perform an action.

Authority differs from a Role:

• A Role identifies responsibilities, permissions, and expected behaviors
• Authority establishes the recognized right or power to direct actions or make decisions

A Role can confer Authority when an authorized source assigns the Role to an Actor.

Authority differs from responsibility:

• Authority establishes the right or power to direct an action or make a decision
• Responsibility establishes an obligation to perform an action or account for an outcome

An Actor can have responsibility without possessing final decision Authority. An Actor can also possess Authority while delegating performance responsibility to another Actor.

Authority differs from Authorization:

• Authority establishes the recognized right or power to grant permission or make a decision
• Authorization grants permission to perform a specified action or access a specified Resource

An Actor with Authority can issue an Authorization within the scope of that Authority.

Authority must have a defined scope. Authority granted for one Organization, Governance Domain, system, Resource, decision type, or period does not automatically apply outside that scope.

Authority can be delegated only when the source of Authority permits delegation. A delegation should identify:

• The delegating Actor
• The receiving Actor
• The delegated Authority
• The applicable scope
• The effective time
• The expiration time
• The conditions and limitations
• The right to redelegate
• The revocation process
• The applicable Provenance
• The applicable Traceability

Technical access does not establish Authority. Conversely, an Actor can possess Authority but lack the technical access needed to exercise it.

An Organization assigns the Approval Authority Role to a designated User.

The assignment grants the User Authority to make Validation Decisions for a defined DIDO-TE Governance Domain.

The Authority permits the User to:

• Review the applicable Test Runs
• Review the applicable Test Results
• Review the assigned Verdicts
• Review the supporting Evidence
• Apply the approved Validation Criteria
• Approve or reject the proposed Validation Decision

The Authority does not permit the User to modify the Test Results or approve Validation Decisions outside the defined Governance Domain.