ABOM
Authorization Bill of Materials — a portable evidence manifest for human, workload, service, and AI-agent access.
Why ABOM
The full comparison against standards, academic prior art, and commercial tooling is in research/comparison_matrix.md. Three properties are what this project claims as advancing the state of the art, each stated at the narrowest defensible scope — none of them requires a new detection algorithm.
- Cross-identity-type coverage in one document. No standard, product, or preprint found in the novelty-gate review carries human, workload, service, and AI-agent identities inside the same versioned, portable schema.
- Full-lifecycle state, not a snapshot. Declared, approved, computed, observed, exception, revoked, and unverified are distinct, coexisting states, so a consumer sees not just what access exists now but how it was arrived at and whether it was independently observed.
- An evidence-completeness contract. Every code path that cannot fully resolve a grant's
provenance marks it
partialormissingrather than silently defaulting to granted or denied — enforced in the engine and covered by dedicated negative tests, not just stated as intent.
How ABOM compares
Standards / BOM ecosystem
| System | Identity model | Authorization state? | AI-agent / MCP |
|---|---|---|---|
| CycloneDX | Component/service-centric | No dedicated field found | No dedicated schema |
| SPDX 3.0 | Element/relationship graph | Generic relations only | No profile found |
| OSCAL | Control-implementation centric | Not designed for per-identity state | No |
| in-toto / SLSA | Actor-per-build-step | Build-step authorization only | No |
| ABOM | Human / workload / service / agent | declared…revoked, unified | Native (MCP adapter) |
Commercial CIEM / IGA / MCP-governance
| Product / category | Effective-permission graph | Non-human / AI-agent identity | Portable evidence export |
|---|---|---|---|
| Veza Access Graph | Yes, normalizes cloud/SaaS | Vendor-claimed at scale | Proprietary platform only |
| SailPoint ISC | Reporting-level SoD | Growing coverage | Proprietary |
| Saviynt | Transaction-level SoD (ERP) | Yes, per vendor pages | Proprietary |
| MCP gateway vendors | Runtime tool-level control | Core scope | Mostly proprietary logs |
| ABOM | Attenuation-corrected (RQ1) | First-class schema type | Open JSON Schema, signed |
Commercial CIEM/IGA platforms already compute effective permissions and detect toxic combinations at production scale — this project does not claim algorithmic novelty for those functions. What none of them offer is a portable, open, cross-identity-type export format the way a CycloneDX/SPDX component inventory travels across an ecosystem.
Quick start
git clone https://github.com/sunilgentyala/authorization-bom.git
cd authorization-bom
python -m pip install -e ".[dev]"
authbom generate --seed 42 --tenants 2 --output manifest.json
authbom validate manifest.json
authbom analyze manifest.json --now 2026-07-29T12:00:00 --output analysis.json
authbom report analysis.json --format markdown --output report.mdCLI
| Command | Purpose |
|---|---|
authbom generate | Deterministic synthetic manifest for testing/benchmarking |
authbom import | Parse a read-only source fixture (K8s RBAC, OPA, Cedar, OpenFGA, OAuth, MCP) |
authbom validate | Validate against the ABOM JSON Schema |
authbom sign / verify | HMAC-sign / verify grants and attestations |
authbom diff | Diff two manifests' grants |
authbom analyze | Effective-permission, delegation, drift, toxic-combination, revocation analysis |
authbom reconcile | Merge observed runtime evidence into a manifest |
authbom report | Render analysis as JSON / Markdown / SARIF |
Benchmark highlights (RQ1–RQ6)
10 recorded seeds, synthetic multi-tenant fixtures, bounded to the tested environment. Full methodology and raw numbers: research/benchmark_findings.md. Two results are reported honestly as negative or inconclusive rather than reframed as strengths.
| RQ | Question | Result | Status |
|---|---|---|---|
| RQ1 | Attenuation-corrected effective-permission accuracy | 1.0000 precision/recall vs. 0.9745 naive precision | supported |
| RQ2 | Chain-consistency reconstruction vs. depth (2–5 hops) | 1.0000 clean rate at every tested depth | negative result |
| RQ3 | Temporal-context vs. snapshot-diff drift detection | Identical scores — ablation was a no-op on current fixtures | inconclusive |
| RQ4 | Agent-inclusive vs. human-only separation-of-duty scope | 2.00 mean violations surfaced vs. 0.00 human-only | supported |
| RQ5 | Revocation convergence vs. estate size | Unresolved count scales with size; convergence time is a generator constant | partially supported |
| RQ6 | CLI-stage overhead vs. estate size | All 5 stages <51ms at 228 grants, well under the 10s budget | supported |
Threat model (14 abuse cases)
Full mitigations and disclosed residual risk per case: docs/threat_model.md. Cross-cutting stance: missing or unverifiable evidence is always marked explicitly incomplete, never silently treated as granted or denied.
| # | Abuse case | Mitigation |
|---|---|---|
| T1 | Confused deputy | Attenuation-only delegation closure |
| T2 | Privilege escalation via inheritance | Explicit inherited-edge traversal, hop cap |
| T3 | Delegation / scope abuse | Privilege-amplification check |
| T4 | Prompt-injection MCP tool misuse | withinDeclaredScope + drift detection |
| T5 | Token theft and replay | Temporal / contextual constraint checks |
| T6 | Orphaned identities | Owner resolution/revocation check |
| T7 | Policy drift | Declared vs. observed snapshot comparison |
| T8 | Cross-tenant access | Boundary-crossing edge flagging |
| T9 | Excessive scopes | Dormant-grant drift detection |
| T10 | Manifest tampering / rollback | Full-payload signatures |
| T11 | Compromised signing key | Key-management hygiene, disclosed residual |
| T12 | Time-of-check to time-of-use | Explicit evidenceCutoff staleness |
| T13 | Revocation propagation failure | propagatedAt-absence signal |
| T14 | Graph-expansion denial of service | Hop cap + cycle detection |
Documentation
Schema
Versioned JSON Schema + example manifests
Formal model
Effective-permission closure, drift, toxic combinations, revocation convergence
Threat model
14 abuse cases and their mitigations
Architecture
Discover-Normalize-Compute-Attest-Observe-Reconcile-Analyze-Verify
Limitations
Read this before relying on any specific claim
Novelty gate
What's genuinely new vs. prior art
Comparison matrix
Standards, academic, and commercial prior art, with evidence links
Gap analysis
RQ1–RQ6 hypotheses, baselines, rejection criteria
Benchmark findings
Including two disclosed negative/inconclusive results
Citation ledger
Every reference independently verified via Crossref/DataCite
Status
Alpha (0.1.0). Synthetic-benchmark-validated only; not yet evaluated against production authorization estates.