Team, I have drafted NIP-39 [1] proposing a simplified approach to framework authorization for the REST API.
This proposal follows along from the more focused proposal, NIP-24 [2] that deprecated the Restricted component annotation for removal. The Controller-Level Authorization strategy aims to align implemented capabilities with enforceable security boundaries. This approach would eliminate the current mismatch between fine-grained authorization configuration and full control over the system through Processors and other extension components. Regards, David Handermann [1] https://issues.apache.org/jira/browse/NIP-39 [2] https://issues.apache.org/jira/browse/NIP-24
