# Authorization Gap The authorization gap is the difference between evidence that a technical mechanism operated and evidence that the person or institution invoking it had legitimate authority to do so. ## Role in the stage model A management profile, enrollment record, service-tool transaction, certificate, or remote session can establish a mechanism and sometimes an operator identity. It generally does not contain the agreement, employment term, purchase record, court order, consent, or other instrument that would establish legitimacy. The same mechanism may serve enterprise administration, repair, lawful process, criminal abuse, or interpersonal control. Actor class therefore cannot be inferred from the artifact alone. ## Archival rule Separate three questions: 1. What mechanism operated? 2. Who invoked or controlled it? 3. What independent record establishes or contests authorization? Do not answer question 2 or 3 merely from tool nationality, vendor identity, forum language, page adjacency, or the alarming character of the capability. ## Source [[Index - Stages of Interception#The authorization gap|Stages of Interception — The authorization gap]] · [[Observability Asymmetry]].