Change Of Authorization (CoA)

What Change Of Authorization Means in Network Access Control

Change of Authorization, or CoA, is the network-side mechanism that lets an AAA system revise access after the session has already started. It is what turns a static login decision into an enforceable, live policy update.

In practice, CoA matters because posture can change after authentication. A device may fall out of compliance, a user’s privilege may change, or a session may need to be narrowed or terminated without waiting for disconnect or reauthentication. That makes CoA a control-plane action, not merely an access log event.

How CoA Works in AAA and NAC Flows

CoA is commonly used in network access control and RADIUS-based environments to push a new authorization decision to the network access device. The usual effect is reclassification of the session, such as moving an endpoint to a quarantine policy, reducing privileges, or forcing a recheck of access conditions. The Network Access Control (NAC) Guide is a useful companion for understanding how 802.1X, posture, and dynamic policy updates fit together.

Because CoA operates after initial authentication, it sits between identity proof and ongoing enforcement. That is why it is so closely tied to authorization models and policy engines, especially when access depends on device health, location, role changes, or other runtime attributes. For a broader view of those decision models, see the Authorisation Models Guide.

CoA is especially important where access must be adjusted without tearing down the entire environment. It lets operators keep the session alive long enough to enforce the new policy, which is often cleaner than a full disconnect and rejoin cycle.

Why CoA Matters for Session Control and Containment

CoA gives organisations a way to react to changing trust conditions in real time. If a device stops meeting posture requirements, if a user moves into a higher-risk context, or if a session appears suspicious, the access policy can be changed immediately rather than waiting for the original grant to expire.

This is one reason CoA is useful in zero-trust style environments: access is not treated as a one-time verdict. It can be tightened as conditions evolve, which helps reduce blast radius when risk changes mid-session. The IAM and IGA Basics guide covers the broader governance logic behind those decisions.

CoA is also a reminder that “authenticated” does not mean “fixed forever.” A valid login can still become over-permissive if policy, posture, or entitlement changes are not propagated to the live session.

Operational Limits and Common Failure Modes

CoA is only as reliable as the network equipment, policy engine, and AAA integration that support it. If a device ignores the update, if the policy server cannot reach the enforcement point, or if the session is not mapped correctly, the old access state may persist longer than intended.

That is why CoA should be treated as an enforcement dependency, not a decorative feature. Its value depends on whether the infrastructure can actually revise access in place, consistently, and at the right granularity. The Data Access Governance Guide is useful here as a governance analogue, because it frames live access decisions as something that must be owned, monitored, and reviewed.

When CoA is poorly implemented, organisations can end up with stale privilege, delayed quarantine, or policy drift between the AAA system and the enforcement layer. In other words, the control exists only on paper unless the network reliably applies it.

Risk and Threat Considerations

CoA reduces exposure when it works, but it also creates a high-value control path. If an attacker can interfere with the authorization channel, abuse policy updates, or exploit inconsistent enforcement, they may preserve access longer than intended or trigger disruptive policy changes against legitimate users.

Failure mechanism: The main failure modes are stale session permissions, missed quarantine actions, and unauthorized or spoofed policy changes between the AAA system and the enforcement point.

Impact: The result can be over-retained access, delayed containment after compromise, or service disruption if access changes are applied incorrectly or too broadly.

Related resources from NHI Mgmt Group

• Why does redirectless authorization change the trust model for IAM teams?
• Why do agents change the way IAM teams think about authorization?
• How do AI agents change the way IAM teams think about authorization?
• Why do embedded policy decision points change the risk model for authorization?