Decision Authority
VERIDION models who may make accountable security, risk and authorisation decisions, the limits of that authority, and where decisions must escalate. Authority is derived from organisational governance — not inferred from technical access.
12
5
2
1
Access enables action. Authority legitimises decision.
Authority is not transferable by discovery. VERIDION may observe that a person performs a role — that does not grant decision authority. Accountable authority must have provenance.
Security Architect
System-model & architecture conflict validation
Payroll Processing Platform
Architecture assertions
Up to PROTECTED
30 June 2027
Security Assessor
Control effectiveness determination
Payroll Processing Platform
Effectiveness conclusions
Up to PROTECTED
30 June 2027
System Owner
Treatment approval & operational exceptions
Payroll Processing Platform
Within delegated authority
Up to PROTECTED
30 June 2027
Risk Owner
Residual risk acceptance
Payroll Processing Platform
MEDIUM
Up to PROTECTED
30 June 2027
Authorising Officer
System operating authorisation
Payroll Processing Platform
Up to CRITICAL (with executive risk authority)
Up to PROTECTED
30 June 2027
AUTH-003
David Chen
Control effectiveness determination
The same individual would both own implementation of the control and independently assess its effectiveness.
Assign independent Security Assessor.
VERIDION does not change the assignment. This is a governance finding requiring accountable human resolution.
Before DECIDE records a human decision, VERIDION evaluates whether the human possesses the governance authority required to make that particular decision.
Can this Risk Owner accept DEC-026?
Residual Risk Acceptance
MEDIUM
Payroll Processing Platform
PROTECTED
Risk Owner
- Role matchPASS
- Decision rightPASS
- System scopePASS
- Risk limitPASS
- Classification limitPASS
- Validity periodPASS
- Separation of dutiesPASS
Within Delegated Authority
VERIDION evaluates authority from the governance model. This result does not constitute the decision itself.
Can this Risk Owner accept DEC-031?
Residual Risk Acceptance
HIGH
Payroll Processing Platform
PROTECTED
Risk Owner
- Role matchPASS
- Decision rightPASS
- System scopePASS
- Risk limitFAIL
- Classification limitPASS
- Validity periodPASS
- Separation of dutiesPASS
Outside Delegated Authority
A HIGH residual risk exceeds the Risk Owner’s delegated limit. VERIDION does not permit this role to record the decision.
Authorising Officer
- Identity
- Who the person is.
- Access
- What systems and actions they can technically reach.
- Role
- The organisational or security function they perform.
- Authority
- The organisational power to make a particular accountable decision.
- Delegation
- The bounded transfer of authority from an accountable source.
- Decision Right
- A particular type of decision the authority permits.
- Scope
- The systems, information and risk domains authority applies over.
- Limit
- The maximum boundary of the authority.
- Decision
- The actual accountable human determination.
- Authorisation
- Formal permission for a system to operate.