Managing the Lifecycle of Automated Decisions
Access control, authentication, and trace are all key benefits of using a Decision Management System (DMS) like SMARTS™. Together, these features enable an organization to fully manage the lifecycle of their automated decisions.
When the decision logic remains in the application code, it becomes difficult to separate access to and management of decision logic code itself. How would you ensure that only resources with the right roles can modify the logic? How would you be able to sort through all the commit comments to find the ones relevant to the decision? The same problem exists when business data is immersed in application code. This is why database management systems (DBMS) emerged and is now commonplace.
Similar to DBMS, Decision Management Systems separate the decision logic from the rest of the code. Thus, not only can you more easily update decision logic according to business needs, but you can also have more control over and transparency into how updates occur. While access control, authentication, and trace are features that are common to many systems, they’re especially important in managing automated decisions. This is because automated decisions typically occur in high volume and high frequency and directly impacts an organization’s bottom line.
Access Control through Roles
Access Control, or authorization, is the ability to define who has access to what in a DMS. This is done so through roles. Roles define what assets a user has access to and what operations they can perform with those assets. The same user can have multiple roles. Here are basic roles that we recommend:
- Administrator: This role administers the DMS (connecting it to other systems, creating roles/users, etc.). Administrators usually aren’t involved with management of the decision logic. Therefore, usually someone from IT or operations is assigned this role.
- Decision Definer: This role is a main user. Decision Definers manage the requirements and performance of automated decisions. Typically business analysts and domain experts are assigned this role.
- Decision Implementer: This role is also a main user. Decision Implementers designs, implements, tests, and optimizes decision logic. Usually business analysts and domain experts are assigned this role. Sometimes data scientists and business-savvy IT personnel are also assigned this role.
- Decision Tester: This role is responsible for business testing. Decision Testers validate whether the decision logic aligns with business objectives. Often the users that are Decision Implementers are also Decision Testers, but that is not always the case.
- Lifecycle Manager: This role is responsible for managing the decision lifecycle. Lifecycle Managers ensure that all processes involved in requirements to implementation to deployment to retirement are enterprise-compliant.
More Advanced Needs
Depending on how your organization is structured, more nuanced roles may be necessary. For example, several of our enterprise customers have 2 different types of Decision Implementer roles:
- General Decision Implementer: Has the ability to design, implement, test, and optimize all decision logic.
- Restricted Decision Implementer: Has the ability to design and implement only certain parts of the decision logic such as a particular ruleset or model.
In order to create a Restricted Decision Implementer, organizations must be able to define roles at a specific asset level.
Access Control Requirements for a DMS
Given what I just described, here’s what you need in your DMS:
- Role-based access control
- Ability to define what specific decision logic assets a role can access and what specific operations a role can perform on those assets
- Ability to customize pre-defined roles and/or create new ones
You can achieve this level of access control in 2 ways:
- If all decision assets are in a system which is also managed by the enterprise access control system, then you can delegate access control to that enterprise access control system.
- If this is not the case, you can delegate basic access to the enterprise access control system and then manage the finer-grained access control in the DMS.
User Authentication
Authentication goes hand-in-hand with access control. Roles are assigned to users. Authentication verifies that the user is right person and applies any policies to ensure that user continues to be the right person (two-factor authentication, puzzles, password changes, etc.).
Many authentication systems exist, each with one protocol or more. Here are some common protocols:
- LDAP
- WS-Federation
- OAuth2
- OpenID Connect
You can achieve authentication in 2 ways:
- You can delegate authentication to the enterprise authentication system. This approach is more common in a services world with low coupling.
- You can make the DMS only accessible through another application that does the proper authentication.
Tracing
Tracing or tracking enables an organization to understand who does what when. While most people think of change logs, tracing is much more than that. Tracing let’s you know who’s been active and what specific activities they’ve engaged in. This includes importing and exporting assets, generating reports, and triggering simulations.
Tracing is beneficial for the following:
- Situational Awareness: understand what happened recently and why.
- Exception Handling: responding to activities that are outside the norm such as when a certain user carries out a particular operation.
- Forensics: understand the who, what, when, and why of a particular set of operations for compliance or other verification reasons.
A persisted and query-able activity stream supports tracing for Situation Awareness. An integration with the enterprise log management and communication management systems supports tracing for Exception Handling and Forensics.
Regardless your setup, SMARTS™ provides the support for complete access control, authentication, and tracing. This blog is part of the Technical Series, stay tuned for more!
Learn more about Decision Management and Sparkling Logic’s SMARTS™ Data-Powered Decision Manager