Why do passwordless controls still need role-aware authorisation in NHS environments?

Because authentication only answers who signed in, not what that person should be allowed to do once the session starts. NHS teams still need role and attribute rules to prevent broad entitlements, especially on shared devices where access can outlive the immediate task.

Passwordless controls improve the authentication step by reducing password reuse, phishing exposure and help desk reset risk, but they do not define entitlement. Once a user or clinician is signed in, the system still needs role-aware rules to decide which records, functions and workflows that session can touch. In NHS settings, that distinction matters because clinical access, admin access and shared workstation access often overlap operationally but must not share the same reach.

That is why mature programmes treat passwordless as the front door control, and authorisation as the control that limits the rooms behind it. A strong sign-in method can prove the person is likely genuine, yet it cannot infer whether they are ward staff, a contractor, a rota doctor or someone temporarily using a shared device.

Where role-aware authorisation becomes operationally necessary

Role-aware authorisation is the practical layer that stops a successful login from becoming broad standing access. In NHS environments, that usually means combining RBAC with attributes such as location, shift, care setting, device state or patient context, so a clinician only sees what their current duty requires. The stronger the shared-device model, the more important that post-login decision becomes.

This is especially relevant where session continuity outlives the immediate task. A passwordless session may be convenient on a kiosk, tablet or shared terminal, but convenience can become overreach if the application trusts the sign-in event alone. Fine-grained access rules prevent the session from inheriting permissions that were never meant to be always-on.

For practitioners comparing access models, NHIMG’s Authorisation Models Guide is the clearest place to separate role-based and attribute-based decisions from the authentication step itself.

How NHS access fails when authentication and authorisation get blurred

The common failure mode is treating successful passwordless authentication as if it were a blank cheque. If the system does not re-check role and context at the point of action, users can accumulate permissions across wards, systems or time periods that no longer match their job. That creates excessive entitlements even when sign-in is phishing resistant.

Another failure mode is role sprawl. If teams create broad roles to make passwordless rollouts easier, they can hide poor authorisation design behind a modern login method. The better pattern is to keep the sign-in method simple and use policy to narrow access at the application, API or data layer.

For access design and governance, IAM and IGA Basics helps frame where provisioning, access review and entitlement control sit relative to authentication, and Role Mining and Role Design Guide is useful when the real problem is role explosion rather than the login method.

Risk and Threat Considerations

Passwordless reduces credential theft risk, but it can also make over-trust easier if teams assume the session is safe enough to reuse across tasks. In shared NHS environments, the security issue is not only impersonation, it is privilege drift after a valid sign-in, where a legitimate session is able to reach more records or actions than the current role should permit.

Failure mechanism: The application or downstream service trusts the authenticated session without enforcing role, attribute or context checks at the moment of access, so a valid sign-in becomes persistent excess privilege.

Impact: Staff may access inappropriate patient data, perform actions outside their duties, or carry privileged access farther than intended across shared devices and time-limited clinical workflows.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	IA-2 — Identification and Authentication (Organizational Users)	Passwordless changes how users authenticate before access decisions.
	AC-6 — Least Privilege	Role-aware authorisation is needed to limit what a valid session can do.
	IA-5 — Authenticator Management	Passwordless programmes still depend on managed authenticators and recovery paths.
Recommendation — Use IA-2 to prove the user at sign-in, then pair it with access controls for post-login limits. Apply AC-6 to restrict each role to the minimum required actions and records. Use IA-5 to govern authenticators so login strength does not become uncontrolled access.
NIST SP 800-63	AAL — Authentication Assurance Level	The question contrasts strong authentication with separate authorisation decisions.
Recommendation — Use assurance level guidance to strengthen sign-in while enforcing authorisation independently.

Practitioner Guidance

What to verify: Check that authorisation is evaluated at the resource, function or record level, not just at login. If passwordless is in use on shared devices, verify that the session cannot outlive the user’s clinical context or inherit a generic workstation identity.

Decision rule: If the control only proves who the user is, treat it as authentication only; if it also limits what the user can do based on role, attribute or location, it is doing the authorisation job that NHS workflows still require.

What good looks like: The safest outcome is a fast sign-in combined with narrow, explainable entitlements, so a clinician gets access to the minimum set of actions needed for the current task and nothing more.

Practitioner takeaway: Passwordless can remove password risk, but it never removes the need to design and test access boundaries after sign-in, especially where shared devices, shifting duties and mixed clinical roles are part of the operating model.