Policy-as-Code and Fine-Grained Data Access Governance in Multi-Tenant Financial Platforms
Keywords:
policy-as-code, authorization, ABAC, ReBAC, multi-tenancy, Open Policy Agent, Cedar, Zanzibar, row-level security, data governance, financial services, DORA, PCI DSSAbstract
Multi-tenant financial platforms, including banking-as-a-service providers, payment processors, wealth and brokerage platforms, and core-banking SaaS, must enforce authorization decisions that are simultaneously fine-grained, tenant-isolated, auditable, and fast. To date, three converging forces reshaped how these platforms approach the problem: the maturation of declarative authorization languages and engines (Open Policy Agent and Rego, Cedar, and Zanzibar-style relationship engines such as OpenFGA); the extension of governance controls into the data plane through row-level security, column masking, and unified catalogs; and a regulatory calendar that placed explicit, testable obligations on access control, most notably the retirement of PCI DSS v3.2.1 and the run-up to the EU Digital Operational Resilience Act (DORA). This paper synthesizes the current state of practice into a taxonomy of five architectural models for policy enforcement: centralized decision service, distributed sidecar, embedded library, data-layer native enforcement, and relationship-graph authorization. It then analyzes them against a common set of security properties. We argue that no single model is dominant; the defensible design for regulated multi-tenancy is a layered hybrid in which tenant isolation is enforced as a non-negotiable invariant at the lowest layer, while business-level entitlements are expressed as versioned, analyzable policy higher in the stack. We identify the principal trade-offs (consistency versus latency, expressiveness versus analyzability, centralization versus blast radius, and fail-closed safety versus availability) and present a reference architecture, a threat model, and a verification regime suited to financial supervision.
Downloads
Published
Issue
Section
License
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
License Terms
Journal of Emerging Intelligence and Engineering Technologies is an open-access journal. Unless otherwise stated, all articles published in the journal are licensed under the Creative Commons Attribution-NonCommercial 4.0 International License (CC BY-NC 4.0).
Full license text: https://creativecommons.org/licenses/by-nc/4.0/
Under this license, you are free to:
- Share: copy and redistribute the material in any medium or format.
- Adapt: remix, transform, and build upon the material.
The licensor cannot revoke these freedoms as long as you follow the license terms.
Under the following terms:
- Attribution: You must give appropriate credit to the original author(s) and the source. Credit should include the article title, author names, journal name, volume, issue, year, and DOI where available. You must also provide a link to the license and indicate whether changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor or the journal endorses you or your use.
- NonCommercial: You may not use the material for commercial purposes. Commercial purposes are those primarily intended for, or directed toward, commercial advantage or monetary compensation.
- No additional restrictions: You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits.
Notices
- You do not have to comply with the license for parts of the material that are in the public domain, or where your use is permitted by an applicable exception or limitation, such as fair use or fair dealing.
- No warranties are given. The license may not give you all the permissions you need for your intended use. For example, other rights such as publicity, privacy, or moral rights may limit how you use the material.
- Third-party content in an article, such as figures, tables, or images reproduced from other sources, may be under different terms. It is covered by this license only if it is stated in the credit line.
Copyright
Authors keep the copyright of their work. By publishing, they grant the Journal of Emerging Intelligence and Engineering Technologies the right of first publication under the CC BY-NC 4.0 license.
Commercial Use
Anyone who wants to use published material for commercial purposes must get written permission from the copyright holder(s). Requests can be sent to the journal's editorial office at [editorial email address].
