Using Property Matrices to Structure Authorization Requirements

Modern information systems contain many mechanisms for implementing authorization and thus are capable of meeting a given authorization requirement with many designs. Each design carries a set of properties that directly impact users, such as administrative effort, risk of compromise, and flexibility. The property matrix method is a method to capture the user requirements for these properties, and thus guide designers in producing an authorization design, without having to educate users about the mechanisms. This paper presents the property matrix method in the context of a simple example, and compares it to some other requirements techniques.