Authenticated Actions
Every Action runs under an authenticated identity, a Person or an agent Worker, recorded as its `by`.
Every Action runs under an authenticated identity, a Person or an agent Worker, recorded as its by.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC6.1 | The entity implements logical access security software, infrastructure and architectures over protected information assets. |
| ISO27001 A.5.16 | The full life of every identity is managed. |
| ISO27001 A.8.5 | Secure authentication technologies and procedures are implemented according to access restrictions. |
| HIPAA 164.312(d) | The entity verifies that a person or entity seeking access is the one claimed. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every Action in the report period. |
| Assert | Each records a by that resolves to an authenticated Worker or Person, and none ran anonymously. |
Owner
Security Engineer, Engineering Team.
Example
A webhook arrives with no valid signature asking to mark an Order paid. No authenticated identity can be recorded as by, so the Action never runs.