Definition
Everything a system is permitted to do at a given moment, recorded as a set of grants, each with the evidence behind it, its scope, its current state, and its expiry. The surface is described by authority rather than by access points: an unused grant is still part of it, and a reachable capability with no grant behind it is not part of it at all.
Every element of the surface is an authority grant that can be narrowed, suspended, or allowed to lapse, which is what makes the surface governable rather than merely documented. Comparing the surface against the capability catalog is the direct test of whether capability has outrun permission, and a wide surface leaves people a real challenge only when each grant in it can be challenged.
What is a permission surface? — the explainer, with a worked example
Hypothetical example
- A tenant can pause automated collections, download their case record, and request human review without manager pre-approval.
References
- Worked examples · Essay
- Governance taxonomy · Resource