Permission–Entitlement Crosswalk¶
Implementation translation — instantiates Rights–Freedoms Obligation Mapping
Maps technical permissions against substantive entitlements to catch capabilities with no claim behind them and claims the system cannot actually execute.
The Permission–Entitlement Crosswalk is a two-column map that lines up what a system technically lets actors do against what they are substantively entitled to, and reads off the mismatches. Its defining move is translation between two representations of the same relation — the permission table (roles, keys, capabilities) on one side, the entitlement set (warranted claims and immunities) on the other — so that neither is trusted as a proxy for the other. It hunts three specific gaps: a capability with no entitlement (the system permits an act nobody has a warranted claim to), an entitlement with no capability (a promised claim the software cannot execute), and a permission with no warrant (an access that traces to no legitimate source). It exposes and characterizes these gaps; it does not fix them.
Example¶
A SaaS company reconciles its access-control system against its customer contracts. On the permission side: role definitions, API keys, and feature flags. On the entitlement side: what each subscription tier is contractually owed. The crosswalk lines them up row by row. A capability-without-entitlement surfaces: any support engineer's role can read customer message contents, though no contract or policy grants that access — a technical permission that traces to no warrant, exactly the kind of "we can, therefore we may" the crosswalk is built to catch. An entitlement-without-capability surfaces on the other side: the enterprise tier contract promises customer-initiated data export within 24 hours, but no such export exists in the product — a claim the software cannot execute. A third row shows a legacy admin key still active from a decommissioned integration: a permission whose warrant expired. None of these is visible from either list alone; all three appear only when the two are set beside each other. The output is a gap register — capability to revoke, entitlement to build, key to retire — handed to whoever owns the fix.
How it works¶
- Build both columns from source. Pull permissions from the actual system (roles, ACLs, keys, flags), and entitlements from the actual warrant (contracts, policy, law), not from memory or intent.
- Line up by relation, not by name. Match a permission to the entitlement it is supposed to implement; a permission with no entitlement row, or an entitlement with no permission row, is the finding.
- Test each permission for warrant. For every capability, ask what legitimate source authorizes it; an unwarranted capability is technical authority masquerading as a right.
- Test each entitlement for executability. For every warranted claim, ask whether the system can actually deliver it and whether capacity exists behind it.
Tuning parameters¶
- Reconciliation grain — role-level versus individual-permission-level matching. Fine grain catches narrow leaks but multiplies rows; coarse grain is fast but misses edge capabilities.
- Warrant strictness — how strong a source a permission needs (explicit contract clause versus general policy) before it counts as warranted. Strict warrant catches more unauthorized access but flags many defensible ones for review.
- Direction emphasis — whether the pass prioritizes hunting capability-without-entitlement (over-permission, a security risk) or entitlement-without-capability (under-delivery, a broken promise). Each direction protects a different failure.
- Refresh trigger — whether the crosswalk re-runs on every permission change and contract revision, or on a schedule. Continuous re-runs catch drift early but cost tooling.
When it helps, and when it misleads¶
Its strength is that it breaks the silent equation of can with may: it refuses to treat an existing permission as evidence of a right, or a written entitlement as evidence of a working feature, and it makes both kinds of gap into concrete, ownable line items. Its named risk is privilege creep — permissions that accumulate past their warrant as roles evolve, integrations linger, and exceptions ossify, until the access map no longer reflects any legitimate entitlement.[n1] The crosswalk is the standing check against it, but its failure mode is over-trusting the entitlement column: if the contracts and policy it maps against are themselves incoherent, the crosswalk faithfully certifies capabilities against a flawed baseline and calls the gaps closed. The guarding discipline is to keep the crosswalk downstream of a real relation map, so it is reconciling against warranted entitlements rather than against whatever the paperwork happens to say.
How it implements the components¶
liberty_and_noninterference_zone— a bare technical permission is treated as a capability/liberty, mapped and tested for whether any claim or warrant actually stands behind it.authority_source_and_warrant_record— each permission is traced to its legitimating source, separating what the system can do from what an actor is authorized to do.positive_enablement_and_capacity_map— each entitlement is tested for whether the system can execute it and whether capacity exists to deliver it, catching promised claims with no working implementation.
The crosswalk finds gaps but does not remediate them: it neither traces a breach through to verified closure nor versions a change — remedy_enforcement_and_review_path and change_revocation_and_transition_rule belong to the Remedy Traceability Review, its nearest twin — and it assigns no accountable duty owners.
Related¶
- Instantiates: Rights–Freedoms Obligation Mapping — the crosswalk is the implementation-translation stage that reconciles executable permissions against substantive entitlements.
- Consumes: Counterparty Obligation Register supplies the warranted entitlements the permission column is reconciled against.
- Sibling mechanisms: Hohfeldian Relation Matrix · Claim–Liberty Classification Tree · Counterparty Obligation Register · Rights-Conflict Scenario Table · Least-Restrictive Alternative Screen · Proportionality Balancing Record · Remedy Traceability Review
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: Permission–Entitlement Crosswalk operates as a bounded evaluation of existing evidence or work that produces a finding or disposition because it maps technical permissions against substantive entitlements to catch capabilities with no claim behind them and claims the system cannot actually execute.
Independent corroboration: The frozen evidence defines Permission–Entitlement Crosswalk as 'Maps technical permissions against substantive entitlements to catch capabilities with no claim behind them and claims the system cannot actually execute', so its operative form is Assessment, Review & Assurance.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Law & Governance
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Permission–Entitlement Crosswalk is rooted in law and governance: Rights analysis distinguishes substantive entitlement from the technical ability to exercise it.
Related originating lineages:
- Computer Science & Software Engineering — Computer science and software engineering materially shaped Permission–Entitlement Crosswalk through algorithms, software architecture, security, and distributed systems. Access-control permissions supplied the executable capability side and matrix comparison form.
- Ethics of Technology & AI Governance — Technology ethics and ai governance materially shaped Permission–Entitlement Crosswalk through platform accountability, technology-specific harms, and appeals.
Review resolution: Both blind reviewers agree that law and governance is the primary origin. Reconciliation resolves alternate_origin_disagreement. Formative alternate lineages are retained as computer_science, tech_ethics_ai_governance; later breadth of use is recorded separately as domain_reach=multi_domain, while origin_mode=cross_disciplinary_synthesis describes the relationship among origin lineages.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
[n1] Privilege creep — the gradual accumulation of access rights beyond what a role or purpose warrants, as people change duties and old permissions are never revoked. It is the concrete form of treating technical capability as if it were entitlement, which the crosswalk's permission-to-warrant test is designed to surface. ↩