CVE-2026-58704

Mandates that access-control decisions are made and applied to each request before access occurs.

Requires a tamperproof, always-invoked reference monitor that performs authorization checks.

Directly requires enforcement of approved authorizations for every access request, stopping improper or missing checks.

AC-4 mandates use of information flow enforcement mechanisms to control data movement.

Limits granted privileges so that even a bypassed check affects fewer resources.

SC-2 requires separation of user and system functionality as a protection mechanism.

PR.AA-01 supplies managed identities and access-request workflows that can support downstream authorization decisions, yet does nothing to enforce or verify authorization checks inside a product, leaving CWE-285 fully unaddressed by this control alone.

Enforcing authentication directly implements a core protection mechanism whose absence or misuse is the CWE.

Cryptographic and integrity controls are protection mechanisms whose correct deployment mitigates the CWE.

Encryption and integrity protections for transit are explicit protection mechanisms.

By requiring documented authorization rules and periodic policy reviews, the control makes it less likely that authorization decisions will be omitted or implemented inconsistently across applications.

Mapping access rights to information classification and business requirements forces correct enforcement of authorization decisions, blocking the incorrect authorization weakness at the policy and implementation stage.

Independent reviewers evaluate whether authorization logic matches policy, thereby reducing the window in which incorrect or missing authorization checks remain in production.

By requiring managers to verify that authorization decisions match policy and to remediate deviations, the control limits the persistence of incorrect or missing authorization checks.

Requiring authorization processes and privilege assignments to be specified during project initiation prevents downstream components from receiving overly broad or incorrect rights that would allow unauthorized actions.

Hardening devices, disabling vulnerable protocols, and maintaining accurate network diagrams reduce the likelihood that a protection mechanism is misconfigured or left in a weak state.