Section 80 of 101
79. Authorization and Role Management
Stable section ID: S05-CON-006-SECTION-80 · 41 content blocks
- Authorization determines which actions an authenticated identity is permitted to perform.
- The BIOS shall enforce least privilege, separation of duties, limited delegation, and explicit scope.
Authorization may combine:
role-based permissions;
capability-based permissions;
location-based permissions;
state-based permissions;
time-limited permissions;
task-specific permissions;
emergency permissions.
Roles may include:
occupant;
owner;
building administrator;
installer;
commissioning authority;
inspector;
maintenance technician;
licensed engineer;
manufacturer service;
security administrator;
robot operator;
AI service;
emergency responder;
certification authority.
Each authorization assignment shall define:
authorized identity;
role or capability;
permitted actions;
affected entities;
location;
operating mode;
validity period;
supervision requirement;
prohibited actions;
- revocation conditions.
- No role shall receive unrestricted authority merely for administrative convenience.
High-consequence actions may require separation of duties. For example, one party may prepare a configuration change while another approves its activation.
AI agents shall receive narrowly defined access. Read access to verified configuration shall not imply permission to issue physical commands or change policy.
Manufacturer service personnel shall receive access only to authorized products and related information necessary for the approved task.
Emergency authorization shall be available where required but shall remain visible, limited, auditable, and subject to post-event review.