OR-003c — Security Domain Resource Enforcement

Go to OR-003 — Classified and Unclassified Environments

Statement

Crucible SHALL prevent an operation from accessing a resource not authorized for the operation's governing Security Domain.

Derived From

This requirement derives from:

Crucible System Requirements Specification, Version 1.1 Draft, Operational Requirements, OR-003The Original Requirement states:

The system SHALL support classified and unclassified deployment environments.[C1]

OR-003c isolates the obligation to prevent a Crucible operation from accessing a resource outside the authorization boundary of its governing Security Domain.

Rationale

A Classified Environment or Unclassified Environment can contain resources governed by different Security Domains.

Execution within an authorized environment does not by itself authorize access to every resource within that environment.

OR-003c prevents a Crucible operation from crossing the resource boundary established for its governing Security Domain.

The responsible authority establishes the Security Domain and identifies its authorized resources. Crucible enforces the established authorization.

Applies To

This requirement applies to:

Crucible operationsSecurity DomainsResources accessed by Crucible operationsClassified EnvironmentsUnclassified Environments

Verification

Verification confirms that:

Each tested Crucible operation identifies its governing Security DomainThe governing Security Domain identifies the resources authorized for the tested operationCrucible permits the tested operation to access a resource authorized for the governing Security DomainCrucible prevents the tested operation from accessing a resource not authorized for the governing Security DomainCrucible records each resource-access denial caused by a Security Domain restrictionEach denial record identifies the operation, governing Security Domain, requested resource, and denial result

Referenced By

The following pages reference this requirement:

Delivery Phase

Implementation Status

Requirement Status

Issues

Notes for Editors

This requirement page should retain the stable requirement identifier OR-003c.

This page is a leaf requirement page and omits a trailing :start from its namespace.

OR-003c requires enforcement of an established Security Domain resource boundary. It does not require Crucible to establish, authorize, or define a Security Domain.

The responsible authority establishes:

The Security Domain identifierThe Security Domain boundaryThe governing security policyThe resources authorized within the Security DomainChanges to the Statement should preserve:

as the responsible actorPrevention as the required behaviorA Crucible operation as the subject of enforcementA resource as the controlled objectThe governing Security Domain as the source of authorizationTo reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003:or-003c#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.