OR-003g — Security Domain Access Control

Go to OR-003 — Classified and Unclassified Environments

Statement

Crucible SHALL deny an access request that the governing Security Domain does not authorize for the requesting identity.

Derived From

This requirement derives from:

Crucible System Requirements Specification, Version 1.1 Draft, Operational Requirements, OR-003The Original Requirement states:

The system SHALL support classified and unclassified deployment environments.[C1]

OR-003g isolates the obligation to deny access requests not authorized for the requesting identity within the governing Security Domain.

Rationale

Operation within an authorized Classified Environment or Unclassified Environment does not authorize every identity to access every operation, resource, or information object within that environment.

A Security Domain establishes the authorization boundary governing identities and access requests within its scope.

OR-003g requires Crucible to deny an access request when the governing Security Domain does not authorize the requesting identity to perform the requested access.

Applies To

This requirement applies to:

Requesting identitiesAccess requestsCrucible operationsResources accessed through CrucibleInformation accessed through CrucibleClassified EnvironmentsUnclassified Environments

Verification

Verification confirms that:

Each tested access request identifies the requesting identityEach tested access request identifies its governing Security DomainEach tested access request identifies the requested accessThe governing Security Domain provides an authorization decision for the requesting identity and requested accessCrucible permits an access request authorized for the requesting identityCrucible denies an access request not authorized for the requesting identityCrucible denies an access request when the requesting identity cannot be determinedCrucible denies an access request when the governing Security Domain cannot be determinedCrucible records each access denialEach denial record identifies the requesting identity, governing Security Domain, requested access, and denial result

Referenced By

The following pages reference this requirement:

Delivery Phase

Implemented and Verified.

Implementation Status

Requirement Status

Issues

Notes for Editors

This requirement page should retain the stable requirement identifier OR-003g.

This page is a leaf requirement page and omits a trailing :start from its namespace.

OR-003g governs whether a requesting identity may perform requested access within a Security Domain.

The responsible authority establishes:

The recognized identity typesThe authentication requirementsThe roles or attributes associated with an identityThe access actions subject to authorizationThe authorization policyThe conditions under which access is permitted or deniedChanges to the Statement should preserve:

as the responsible actorDenial as the required behaviorAn access request as the evaluated subjectThe requesting identity as the entity seeking accessThe governing Security Domain as the source of authorizationOR-003g differs from the other Security Domain requirements:

OR-003c prevents an operation from accessing an unauthorized resourceOR-003d prevents an operation from processing unauthorized informationOR-003e enforces the Information Handling Rules governing authorized informationOR-003f controls information transfer between Security DomainsOR-003g determines whether the requesting identity is authorized to perform the requested accessTo reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003:or-003g#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.