Risk-Aware Access Control for Distributed Enterprise Applications

Abstract

Access control for enterprise applications has evolved from static role-based models toward attribute-based models capable of evaluating many contextual factors at decision time, and more recently toward zero-trust architectures that treat every request as untrusted regardless of its network origin. Each of these advances improves on its predecessor, but a gap persists between the access control decision itself and the behavioral and contextual risk signals an enterprise can actually observe in real time: a policy decision point typically evaluates a request’s attributes as they stood at authentication time, while a user’s or service’s behavioral risk profile can change meaningfully within the same session, and a distributed enterprise application built from many independently deployed microservices compounds the problem by giving each service its own enforcement point, which can apply a stale or inconsistent version of the same nominal policy. This paper proposes RADAR (Risk-Adaptive Dynamic Access Regulation), an architecture in which a contextual risk-scoring engine continuously evaluates behavioral and environmental signals, a risk-adaptive policy decision point combines this continuous risk score with attribute-based policy rather than evaluating attributes alone, and a distributed enforcement layer propagates the resulting decision consistently to per-service enforcement points across a microservice-based enterprise application. Following a design-science research approach, RADAR is illustrated, not empirically validated, through a comparative capability table, a short case scenario, and two illustrative figures, with every quantitative value explicitly labeled as an illustrative estimate rather than measured production data. The paper situates RADAR against the literature on role-based and attribute-based access control, zero-trust architecture, continuous and behavioral risk signals, and distributed enforcement in microservice and cloud-native systems.