Symphonic – Intelligent Authorization

Over the past decade, IT environments have grown more complex due to accelerating technology change, shifting social expectations, mobile-first access, and increasingly distributed application deployments. With smartphones now the dominant end-user device, organizations must secure access to corporate data from uncontrolled locations and on devices that are easily lost or stolen. At the same time, data-hungry AI programs and application integrations rely heavily on APIs, creating additional needs for robust API security plus disciplined key and token management. Hybrid architectures—spanning on-premises systems, cloud services, and containerized environments—make consistent authorization harder, pushing organizations beyond simple role-based access control toward fine-grained, context-aware decisions.

Symphonic’s approach centers on an authorization service composed of Policy Enforcement Points (PEPs), a Policy Decision Point (PDP), Policy Information Points (PIPs), Policy Information Orchestration, and a Policy Administration Point (PAP). Policies evaluate richer signals than role alone, including user attributes (training, travel location, behavioral risk scores) and device attributes (password protection, jailbreak status, presence of corporate containers). Symphonic supports multiple PEP patterns (gateways/firewalls/API hooks, embedded code for legacy apps, and optional PDP embedding), while recommending HTTP-service PDP deployments for scalability and monitoring. The solution can use Symphonic’s JSON protocol or XACML, supports complex PDP topologies to reduce latency, and provides policy diagnostics to reduce errors in combining algorithms that can lead to “indeterminate” outcomes.

A “Trust Framework” binds connectors, attribute definitions, and orchestration so attributes can be sourced, transformed, and consistently reused across applications. Administration is designed to be business-driven via drag-and-drop tooling, backed by automated policy analysis and SDLC-aligned packaging, migration, and regression testing. Symphonic targets regulated and high-risk sectors and highlights licensing based on company size to support varied architectures without per-deployment cost penalties.

• Smartphones are the predominant end-user device.
• Authorization decisions commonly return “Permit” or “Deny,” and can also include obligations.
• Symphonic can integrate PEPs via firewalls and API gateways using API hooks or connectors.
• Legacy applications can use embedded custom code to provide access control functionality.
• Symphonic supports deploying the PDP as an HTTP service and also supports embedding the PDP in the relying application.
• Customers can use Symphonic’s proprietary JSON protocol or the XACML protocol definition.
• Multiple PDP instances can be deployed to minimize network latency and to fit network segmentation such as firewalled subnets.
• Symphonic provides connectivity capabilities to over 200+ data protocols.
• Attribute transformations can be performed using JSON Path, XPath, and SpEL (Spring Expression Language).
• Symphonic’s licensing model is based on company size rather than being server-based, avoiding per-deployment license fees.

• “Smartphones are now the predominant end-user device.”
• “AI programs with a rapacious appetite for data often use APIs to diverse applications and data repositories, adding a requirement for sophisticated key or token management to the access control task.”
• “In an environment with such complexity an Authorization service is typically employed to facilitate fine-grained, context-aware, access control with centralized administration for consistent application of policy.”
• “Access control decisions are determined by the PDP via an analysis of the pertinent policies for the requested access.”
• “In some cases an obligation will be included.”
• “Deploying the PDP as an HTTP service is preferable since this more architecturally sound and facilitates scaling and monitoring of access by relaying applications.”
• “In policy decision-making combining algorithms can be a source of logic errors which might result in an ‘indeterminate’ response if not corrected.”
• “Policy administration is business-driven, it is not the purview of the IT department.”
• “Symphonic’s design principles facilitate an SDLC-based approach to the deployment of configuration updates and policy tree changes.”
• “Decisions are made at run-time enabling highly context-dependent decisions that reflect the pertinent facts about the environment in which the resource access request was made, at the exact point in time at which the request was made.”