Use complete mediation by checking every access request at the point of use, not only at initial login or before the first request. Revalidate permissions after role changes, object transfers, and session changes, and centralise authorisation decisions where possible. Cache cautiously, expire cached decisions quickly, and audit paths that bypass normal enforcement.
Why complete mediation is the control that keeps access decisions current
complete mediation is about making the access check part of the action itself, not a one-time gate at sign-in. The control matters because permissions, ownership, object state, and session context can change after initial authentication. Without point-of-use checks, a request can succeed on stale assumptions even when the underlying access right is no longer valid.
A practical design keeps authorisation close to the resource or enforcement point so the decision reflects the latest policy state. That usually means rechecking after role updates, ownership changes, delegation changes, and session transitions. Centralising the decision logic can reduce drift, but it only helps if every path still calls that logic rather than caching a once-approved result indefinitely.
For systems that handle APIs or service-to-service calls, this principle is especially important because indirect paths often bypass the main UI or login flow. The same access rule must apply whether the request comes from a browser, background job, integration, or internal service. That is why access control guidance in NIST Cybersecurity Framework 2.0 and NIST SP 800-53 Rev 5 Security and Privacy Controls is often read alongside complete mediation when teams design enforcement points and audit checks.
Where stale decisions usually appear in real systems
The most common failure is treating authentication as if it were also authorisation. A user or process may be valid at login, but that does not mean it should keep the same rights after a transfer of ownership, a change in role, a token refresh, or a policy update. If the application stores the earlier decision and reuses it too broadly, the system drifts away from current policy.
Another common gap is inconsistent enforcement across layers. One component may check access correctly while another trusts forwarded claims, session state, or cached entitlements. That creates bypass paths through alternate endpoints, batch jobs, internal admin tooling, or legacy integrations. The weakness is not just missing checks, it is missing checks at every point where the protected object can actually be reached.
This is also why request-level mediation often pairs with strong identity and session handling. When the subject can be reached through user, service, or API paths, the relevant control point is the action, not the login event. Resources such as OWASP API Security Top 10 and NIST SP 800-63 Digital Identity Guidelines reinforce the need to keep authentication state and access decisions separate.
How to reduce the blast radius when full mediation is hard to implement
Some systems cannot afford a fresh policy lookup on every call, so the mitigation becomes careful cache design rather than removing caching entirely. Short-lived cached decisions, explicit invalidation on policy or ownership change, and narrow cache scope all help limit the time window in which a stale decision can be abused. The goal is to make the cached answer behave like a current answer, not like a permanent exception.
When latency or legacy design prevents ideal enforcement, focus on the most sensitive objects and the most dangerous transitions first. High-value records, cross-tenant resources, privilege changes, and delegated access paths deserve the strongest revalidation. A system that cannot mediate everything equally well should at least mediate the cases where stale authorisation would create the largest impact.
Internal design guidance on this topic is well supported by the CWE Top 25 Guide, which helps teams trace the weakness back to validation and access-control failures. For teams doing operational risk analysis, the AI Risk Assessment Guide is useful when access decisions are embedded in automated workflows that need periodic reassessment.
Risk and Threat Considerations
When mediation is incomplete, an attacker or insider may exploit the gap between a valid initial check and a later state change. A user can retain access after a role downgrade, a moved record can remain readable under the old owner, or a revoked session can keep acting until the cache expires. The risk is not only unauthorised access, but also silent use of legitimate-looking requests that bypass normal enforcement.
Failure mechanism: The system trusts an earlier approval, cached entitlement, or non-current session state instead of re-evaluating the request against the present policy and object state at the moment of use.
Impact: Sensitive data exposure, privilege persistence after revocation, unauthorised object access, and a wider attack surface through bypassable enforcement paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | Complete mediation depends on current access decisions at enforcement time. |
| Recommendation — Revalidate access at the point of use and keep authorization decisions current. | ||
| NIST SP 800-53 Rev 5 | AC-3 — Access Enforcement | The topic is about enforcing access decisions on each request path. |
| AC-6 — Least Privilege | Stale mediation failures often leave users or processes with excess effective access. | |
| Recommendation — Enforce access decisions on every protected object and request path. Limit permissions so stale decisions expose the smallest possible blast radius. | ||
| OWASP ASVS | V8 — Authorization | The question concerns application-level authorization checks and bypass paths. |
| Recommendation — Verify that authorization is enforced consistently at each sensitive function. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Complete mediation is an access-control discipline that depends on timely revocation and review. |
| Recommendation — Review and revoke access quickly when roles, ownership, or sessions change. | ||
Practitioner Guidance
What to verify: Confirm that every protected action has a current enforcement point, and that role changes, ownership transfers, delegation changes, and session events trigger revalidation or cache invalidation. If any path can reach the object without that check, the control is incomplete.
Common mistake: Teams often protect the main application flow but leave administrative APIs, background jobs, and legacy integrations on weaker checks. That creates a false sense of coverage because the easiest path is protected while the most valuable path may not be.
Practitioner takeaway: Complete mediation is less about where access is first approved and more about whether the system can still make the right decision when context changes after approval.