Not using complete mediation happens when a system checks a permission or security condition only once and then reuses that result without rechecking every access. Attackers can exploit changes in state, revoked privileges, or swapped objects after the initial check. Defenders should revalidate sensitive operations, bind checks to the exact resource, and avoid stale authorisation decisions.
Why Complete Mediation Fails
complete mediation fails when access decisions are treated as a one-time gate instead of a condition that must still hold at the moment of use. That creates a gap between the check and the action. If the object, privilege, session, or execution context changes in that gap, the earlier decision is no longer trustworthy.
The root problem is stale trust. A system may cache an allow decision, assume a path stays safe after the first validation, or reuse a token, object reference, or permission result without binding it to the exact resource and state being acted on. That is why time-of-check and time-of-use gaps are so often involved.
Complete mediation is especially important when access depends on mutable state. Permissions can be revoked, ownership can change, a record can be swapped, or a linked object can be replaced after the initial check. If the application does not re-evaluate the sensitive action, the attacker gets a window to exploit the difference between what was checked and what is now true.
What Attackers Exploit in the Gap
Attackers look for any point where the system trusts an earlier decision too much. Common abuse patterns include reusing a previously authorised session, substituting a different object after validation, or triggering a state change after approval but before the protected operation completes. The flaw is not the permission check itself, but the failure to keep the check aligned with the exact resource and moment of use.
This becomes more dangerous when the operation has side effects. A stale decision on a read may expose data; a stale decision on a write, delete, transfer, or approval can create irreversible impact. The practical issue is that the control boundary is too early, too coarse, or detached from the final action.
Where the subject involves access-control design, the lesson is to treat every sensitive operation as needing its own authoritative decision point, not just the surrounding workflow. The closer the check is to the resource and execution moment, the harder it is to exploit changed state or swapped references.
How to Design Checks That Stay Valid
Good mediation binds the decision to the specific object, the specific action, and the current state. That means revalidating before use, not only at login or at the start of a session. It also means avoiding designs where one approval silently covers later operations that may involve different records, different privileges, or different trust conditions.
Defensive patterns usually include fresh permission checks at the last responsible moment, object-level verification, and invalidation of cached authorisation when state changes. For higher-risk actions, the safest design is to make the operation itself enforce the rule, rather than relying on a caller to remember to check it first.
The same principle applies when permissions are delegated or temporary. If the access decision can expire, be revoked, or depend on mutable attributes, the system should fail closed when the current state cannot be confirmed. That is the operational meaning of complete mediation: no stale shortcut should be able to outlive the condition it depended on.
Risk and Threat Considerations
Incomplete mediation creates a classic race condition and access-control weakness. The longer the gap between validation and use, the more opportunity there is for state drift, privilege revocation, object replacement, or session reuse to turn an approved action into an unauthorised one.
Failure mechanism: A control checks once, then reuses that result after the resource, subject, or permission state has changed, so the later action executes on an assumption that is no longer true.
Impact: Attackers can read, modify, delete, or approve data they should no longer be able to reach, and in transactional systems that can lead to fraud, data corruption, or privilege abuse with little visible warning.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while OWASP ASVS, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V8 — Authorization | Complete mediation failures are authorization failures at the point of use. |
| Recommendation — Enforce object-level authorization at the final decision point before every sensitive action. | ||
| NIST SP 800-53 Rev 5 | AC-3 — Access Enforcement | The flaw is missing enforcement when access is actually used. |
| Recommendation — Apply access enforcement at each sensitive operation, not only during initial validation. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Attackers abuse previously valid access when checks are stale or reused. |
| Recommendation — Monitor for abuse of valid accounts and revalidation gaps that enable continued access. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Complete mediation is an access-control design and enforcement problem. |
| Recommendation — Review and revoke access paths that rely on reusable or stale authorization decisions. | ||
Practitioner Guidance
What to verify: Check whether the access decision is enforced at the point of use, not only during session setup, request entry, or workflow initiation. If the protected object can change between those moments, the design needs revalidation or tighter binding.
Common mistake: Teams often trust a cached allow decision because it reduces overhead or simplifies code. That is acceptable only when the resource and its governing state are genuinely immutable for the lifetime of that decision, which is rarer than it first appears.
Practitioner takeaway: The safer design is not “check once and remember”, it is “check again when it still matters”, especially for operations whose value depends on the exact object and current authority.
Related resources from NHI Mgmt Group
- Guide: CWE Top 25 Guide
- Not Using Complete Mediation
- What do teams get wrong about using pen tests as a complete security validation?
- What breaks when private keys are protected with fragmented controls instead of complete mediation?
- Why does storing credit card data for future transactions create higher compliance and security risk than using it only to complete the current purchase?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org