A permission answers what a caller may do. An identity says who is asking. Each decision happens before the action exists in the form that will run. Neither compares the action that arrives at execution with the action that was authorized.
The machine can prepare the work, and a person still releases the final action.
One reason keeps that step in place. The action can change between the approval and the execution. A change at that point can be consequential, and nobody wants it to happen unseen.
So the work stops at a person even where the machine could continue.
A permission covers a kind of action: may this caller do this sort of thing? An identity answers who is asking. The company decides both before the action reaches the executor.
Neither decision compares the action that arrives with the action that was authorized. A permission wide enough to be useful is also wide enough to allow a changed action. A correct identity stays correct after the action has changed.
| The question | What answers it today | What it leaves open |
|---|---|---|
| May this caller do this kind of thing? | Permissions and policy | A policy covers a class of actions, not the one about to run. |
| Who is acting? | Identity and credentials | The identity still reads as correct after the action has changed. |
| Is the action arriving the one that was authorized? | Nothing, unless a check sits at execution | This is the gap Humsana closes. |
Permissions and identity stay necessary. Each is decided earlier in the workflow than the moment where the consequence happens.
An action leaves the system that authorized it and arrives at the system that executes it. A control inside the first system cannot answer for the action once the action has left it.
So the check sits on the executing side, immediately before the call that cannot be taken back. It compares the action that arrives with the action that was authorized. It answers ALLOW, HOLD or REFUSE, and it records the decision.
A person stops being the checkpoint for every action. Where the action still matches the authority that was granted, it runs without that step. A person is asked only where a decision is genuinely required.
Where an action should stay with a person, it stays with a person. The assessment finds which actions those are.
Where can an approved action still change before it runs?
Tell us about the workflow. We will show you where a check at execution closes the gap. We will also show you where the action should stay with a person.