"authorization" and governance linkage

[darrellodonnell]

The definition of authorization is currently using a NIST definition (NIST NIST SP 800-57 Part 2 Rev.1 under Authorization).

Access privileges granted to an entity; conveys an “official” sanction to perform a cryptographic function or other sensitive activity.

There is no explicit linkage to governance. On a technical view that's fine. However, lacking linkage to governance leads (IMO) to decisions that are made lacking some context.

May need a governed authorization (or equivalent) term to help link tech+governance.

[darrellodonnell]

another thought - we could link "governed action" as that is a key construct (key activity?) from our EGF templates.

[darrellodonnell]

@talltree FYI