Entitlements as Code by MoreThanOps

Where Entitlements as Code comes from

Two traditions meet here, one from software engineering and one from identity governance.

Last reviewed

Entitlements as Code is not a new invention so much as a meeting point. Software engineering learned to manage change with version control, review and reconciliation. Identity governance learned which rules access must follow to be safe and auditable. Each half is decades old; this page traces both, with the sources at the end.

From engineering: change as reviewed code

Review before it ships. Formal review of changes by someone other than their author goes back at least to Michael Fagan's code inspections at IBM, published in 1976 [1]. Today's pull request is the everyday form of that idea: a proposed change, a diff, a reviewer, a record.

Declare the desired state. Mark Burgess's CFEngine, described in 1995, let administrators declare how machines should be configured in files and have a program bring them to that state [2]. That idea grew into Infrastructure as Code, which Martin Fowler describes as "the approach to defining computing and network infrastructure through source code" [3]. Terraform, announced in July 2014, made the plan-then-apply cycle the common way to change infrastructure [4].

Git as the source of truth. In 2017 Weaveworks named GitOps: running operations from Git, with changes made by pull request [5]. The OpenGitOps project later wrote its principles down: the desired state is declarative, versioned and immutable, pulled automatically, and continuously reconciled by software agents that observe the actual state [6].

Rules as code. Policy as code put rules into versioned, testable files: Open Policy Agent released its first version in 2016 and graduated in the Cloud Native Computing Foundation in 2021 [7]; HashiCorp announced Sentinel in 2017 [8].

From identity governance: rules for safe access

Least privilege and two keys. In their 1975 paper "The Protection of Information in Computer Systems", Jerome Saltzer and Michael Schroeder set out design principles still quoted today [9]:

  • Least privilege: "Every program and every user of the system should operate using the least set of privileges necessary to complete the job."
  • Separation of privilege: a mechanism that "requires two keys to unlock it is more robust and flexible than one that allows access to the presenter of only a single key."

Separation of duties. NIST defines it as the principle "that no user should be given enough privileges to misuse the system on their own" [10]. NIST SP 800-53 turns these ideas into named controls: account management with approvals and periodic reviews (AC-2), separation of duties (AC-5) and least privilege, including the review of user privileges (AC-6) [11].

Roles. Role-based access control was formalised in 1992 by David Ferraiolo and Rick Kuhn and became the ANSI/INCITS 359 standard in 2004 [12]. Roles and groups are the entitlements most organizations manage today.

Identity governance and administration. Over the following decades, identity governance gathered the practices that run access day to day: access requests with approval by a manager or a resource owner, the joiner, mover and leaver lifecycle, and periodic access reviews, also called recertification [13].

Why audits care

Auditors ask for these practices because the frameworks they test against do:

  • Sarbanes-Oxley, Section 404 (2002) requires management to report on internal control over financial reporting, and the outside auditor to attest to it [14]. The law does not mention systems or access; user access reviews come from how auditors test the IT controls behind financial reporting.
  • ISO/IEC 27001:2022 lists access controls in its Annex A, among them segregation of duties (5.3), access control (5.15), access rights (5.18) and privileged access rights (8.2) [15].
  • SOC 2 criteria CC6.1 to CC6.3 cover logical access, including registering and authorizing users before granting access and changing or removing access with least privilege and segregation of duties in mind [16].

What Entitlements as Code adds

Identity governance knew what access needs: an owner's approval, separation of duties, end dates, reviews, a record. Engineering knew how to manage change well: declare it in Git, review it as a pull request, reconcile the systems to it. Entitlements as Code applies the second to the first. The approval and the change become one reviewed pull request, the record is the Git history, and drift is what continuous reconciliation finds.

Others have applied the same idea. In 2022 GitHub open-sourced Entitlements, the tool it used internally: a Git repository as the source of truth for declarative authorizations, every change through a pull request with approvals, a durable audit trail and expirations [17]. Entitlements as Code names the method behind that kind of system, so any team can apply it to its own identity provider and platforms, with its own tools or with a product.

Sources

  1. M. E. Fagan, "Design and Code Inspections to Reduce Errors in Program Development", IBM Systems Journal 15(3),
  2. ieeexplore.ieee.org
  3. M. Burgess, "A Site Configuration Engine", USENIX Computing Systems 8(3), 1995. usenix.org
  4. M. Fowler, "Infrastructure As Code", 2016. martinfowler.com
  5. M. Hashimoto, announcement of Terraform, HashiCorp blog, 28 July 2014. hashicorp.com
  6. InfoQ, news article on GitOps at Weaveworks, September 2018. infoq.com
  7. OpenGitOps, "GitOps Principles v1.0.0", 2021. github.com
  8. Cloud Native Computing Foundation, "CNCF announces Open Policy Agent graduation", 4 February 2021. cncf.io
  9. HashiCorp, announcements at HashiConf 2017 (Sentinel), September 2017. hashicorp.com
  10. J. H. Saltzer and M. D. Schroeder, "The Protection of Information in Computer Systems", 1975. web.mit.edu
  11. NIST, glossary: separation of duty. csrc.nist.gov
  12. NIST SP 800-53 Rev. 5, controls AC-2, AC-5 and AC-6 (text as reproduced by CSF Tools). AC-2, AC-5, AC-6
  13. NIST, "Role Based Access Control" project. csrc.nist.gov
  14. Microsoft Learn, "What is Microsoft Entra ID Governance?" and "What are access reviews?". learn.microsoft.com
  15. Sarbanes-Oxley Act of 2002, Section 404, 15 U.S.C. 7262. law.cornell.edu
  16. ISO/IEC 27002:2022, table of contents published by DIN (the Annex A controls of ISO/IEC 27001:2022 share its numbers and titles). din.de
  17. AICPA, "2017 Trust Services Criteria (with revised points of focus, 2022)". aicpa-cima.com
  18. GitHub, "Introducing Entitlements: GitHub's open source identity and access management solution", 2022. github.blog