What identity establishes before authorisation begins

Identity gives the request a principal

Federated identity, MFA and modern authentication can establish a strong principal. That is the right foundation for a secure content product. But the identity system usually does not know the full state of the content object or every action-specific rule around it.

Casewelt therefore treats identity as one layer in the decision chain rather than the whole chain.

Authorisation needs resource context

The content system can evaluate the requested action, the resource, organisation policy, current session and relevant lifecycle state. That is where decisions such as “read is allowed, external share is denied” become possible.

The same model can distinguish human and machine principals without borrowing a person’s session for automation.

Clear layers improve incident response

When identity, session and policy are separated, failures become more informative. A sign-in failure, a revoked session and an explicit policy denial can be handled differently by users, support and security teams.

That clarity also improves audit because the system records why an action stopped rather than only that it stopped.