EmpowerID Governed Authorization

Scope

This whitepaper describes the canonical EmpowerID Governed Authorization architecture—one logical ABAC decision authority, graph super PIP context, and AuthZEN interfaces between PEPs and PDPs. Feature availability and enforcement coverage vary by product edition and integration scope.

Executive summary

Enterprise access is described in many ways—roles, groups, relationships, risk, device state, and agent delegation. The problem begins when each becomes a separate source of authorization truth. EmpowerID Governed Authorization brings those facts into one logical ABAC decision authority: application-defined semantics, PIP and graph super PIP context, governed policy evaluation, and AuthZEN enforcement—without parallel authorization truth.

What's inside

• One logical ABAC authority

  Applications define what access means through App Authorization Contracts. PIPs—including the graph/ReBAC super PIP—assemble facts. One governed policy model runs across distributed PDP instances.

• Graph super PIP, not a second permit

  Relationship intelligence feeds the ABAC decision. ReBAC contributes delegation, ownership, and membership facts—it never issues a competing authorization truth.

• Contribution-aware revocation

  The Grant Contribution Registry records every reason access exists. Remove one contribution; preserve every other legitimate reason—with present-state explanation distinct from change history.

• Authorization before cognition

  For AI agents: govern delegation creation, policy-scoped tool discovery, and invocation-time authorization as three distinct moments under the same logical authority.

Five questions to ask any authorization platform

1. 1Does the graph issue a second permit—or contribute facts to one policy authority?
2. 2Does authorization begin with application-defined semantics, or only with a runtime request?
3. 3Can the platform explain every active contribution—and remove one reason while preserving the others?
4. 4Does agent authorization govern delegation, discovery, and invocation—or only gateway traffic?
5. 5Can UI, API, backend, search, and agent enforcement points share one decision authority?