Intent-Aware Authorization for Zero Trust CI/CD

2025-04-21

AI Summary

This paper addresses the overreliance on static identities and the absence of operational intent modeling in authorization decisions for zero-trust CI/CD systems. To this end, it proposes an intent-aware dynamic authorization paradigm. Methodologically, it integrates SPIFFE workload identities, OPA/Cedar policy engines, credential brokers, and a closed-loop control model to dynamically couple runtime context, operational intent, and human approvals into real-time policy enforcement. Its core contributions are: (i) the first explicit modeling and deep integration of operational intent into a zero-trust authorization framework, enabling fine-grained, auditable, and adaptive access control; and (ii) support for real-time decision-making, verifiable policy execution, and end-to-end traceability in highly dynamic pipeline environments. Experimental evaluation demonstrates significant improvements in software supply chain authorization security and policy responsiveness agility.

Technology Category

• Constraint Satisfaction and Optimization: Distributed CSP/Optimization
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust
• Planning, Routing, and Scheduling: Optimization of Spatio-temporal Systems

Application Category

• Security and Privacy: Authentication, authorization, and access control
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs

Abstract

This paper introduces intent-aware authorization for Zero Trust CI/CD systems. Identity establishes who is making the request, but additional signals are required to decide whether access should be granted. We describe a control loop architecture where policy engines such as OPA and Cedar evaluate runtime context, justification, and human approvals before issuing access credentials. The system builds on SPIFFE-based workload identity and credential brokers, and enables fine-grained, auditable authorization. This is the third paper in a series on Zero Trust CI/CD design patterns.

Problem

• Introducing intent-aware authorization for Zero Trust CI/CD systems
• Evaluating runtime context and approvals for access decisions
• Enabling fine-grained, auditable authorization with SPIFFE identity

Innovation

• Intent-aware authorization for Zero Trust CI/CD
• Control loop with OPA and Cedar policy engines
• SPIFFE-based workload identity and credentials