v4 control objectives need fine tuning

[jmanico]

I think the following objectives are too role-centric, Roles are just one paradigm.

Change:

• Users are associated with a well-defined set of roles and privileges.
• Role and permission metadata is protected from replay or tampering.

To:

• Users are associated with a well-defined set of entitlements.
• Access control policy metadata is protected from replay or tampering.

[Sjord]

Users are associated with a well-defined set of entitlements.

I think "privileges" is more clear than "entitlements". I think the original is also fine.

Access control policy metadata is protected from replay or tampering.

I think this is an improvement. Perhaps remove "policy"?

What do you think about 1.4.5?

1.4.5 Verify that attribute or feature-based access control is used whereby the code checks the user's authorization for a feature/data item rather than just their role. Permissions should still be allocated using roles.

[tghosth]

I agree with Jim's changes, I think entitlements nicely covers both roles and permissions/privileges.

@Sjord, do you want to open a separate issues about 1.4.5 if it has not already been discussed in another issue?

[tghosth]

Opened #1375

[Sjord]

@Sjord, do you want to open a separate issues about 1.4.5 if it has not already been discussed in another issue?

I think this is up to @jmanico.