Complete Mediation
Complete Mediation is one of the foundational secure design principles (originating from Saltzer and Schroeder, 1975) and is a core concept in the CSSLP Secure Software Concepts domain. It states that every access to every object must be checked for authority, every time, without exception. In other words, the system must verify that a subject (user, process, or service) is authorized before permitting any access to a resource, and this check cannot be bypassed, cached indefinitely, or assumed valid based on a prior decision. The principle addresses a common weakness: software that authenticates and authorizes a user once, then trusts subsequent requests without re-validation. Attackers exploit this gap through techniques such as session hijacking, privilege escalation, Time-of-Check to Time-of-Use (TOCTOU) race conditions, forced browsing, and insecure direct object references. If permissions change (for example, an account is disabled or a role is revoked), a system lacking complete mediation may continue to honor stale access rights. In practice, complete mediation is implemented through a reference monitor, a trusted component that intercepts all access requests and enforces the security policy. The reference monitor must be tamper-proof, always invoked (non-bypassable), and small enough to be verified. Secure coding practices supporting this principle include performing authorization checks on every request at the server side rather than relying on client-side controls, re-validating credentials and permissions before sensitive operations, avoiding long-lived authorization caches, centralizing access-control logic to prevent inconsistent enforcement, and ensuring that all entry points (APIs, web interfaces, batch jobs, administrative consoles) pass through the same control. There is a recognized trade-off between complete mediation and performance, since repeated checks add overhead. Secure design accepts this cost or mitigates it carefully with short-lived, invalidatable caches. For the CSSLP candidate, the key takeaway is that trust must be continuously re-established: authorization is a per-request decision, never a one-time event, and this principle works closely with least privilege, fail-safe defaults, and defense in depth to reduce the attack surface.
Complete Mediation: The Principle of Checking Every Access, Every Time (ISC2 CSSLP Guide)
Imagine a nightclub where the bouncer checks your ID at the door, but once you're inside, you can wander into the VIP lounge, the cash office, or the staff-only areas without anyone ever looking at you again. That single check at the entrance creates a false sense of security. In software, this same flaw appears constantly: an application authenticates a user at login, then trusts them for every subsequent request without re-verifying whether they are actually allowed to perform each specific action. Attackers exploit this gap through techniques like Insecure Direct Object References (IDOR), forced browsing, parameter tampering, and privilege escalation.
Complete Mediation is one of the eight classic Saltzer and Schroeder secure design principles (1975), and it remains foundational to the CSSLP Domain 1 (Secure Software Concepts). It is directly tied to real-world breach categories listed in the OWASP Top 10 under Broken Access Control, which has consistently ranked as the number one web application risk. Understanding this principle helps you design systems that fail safely, resist tampering, and enforce policy consistently across every component.
What Is Complete Mediation?
Complete Mediation states that every access to every object must be checked for authority, every time. No request, no matter how routine or how recently it was previously authorized, should bypass the authorization decision. The access control mechanism must be non-bypassable, meaning there is no alternative path to a protected resource that skips the check.
Key characteristics:
• Universal: Applies to all subjects (users, processes, services) and all objects (files, records, APIs, memory, functions).
• Continuous: Authorization is verified on each request, not just once at session establishment.
• Non-bypassable: There are no "back doors," alternative URLs, or direct calls that circumvent the mediation point.
• Skeptical of caching: Cached authorization results must be treated carefully, since permissions can change between the time a decision is cached and the time it is reused.
The concept is closely linked to the Reference Monitor, an abstract machine that mediates all access between subjects and objects. For a reference monitor to be trustworthy it must be: tamper-proof, always invoked (this is Complete Mediation), and small enough to be verified. The implementation of a reference monitor in a real system is called the Security Kernel.
How Complete Mediation Works in Practice
1. Centralized Authorization Checkpoint
Rather than scattering permission logic throughout thousands of lines of code, secure designs funnel every request through a single, well-tested authorization layer (middleware, gateway, interceptor, or policy decision point). This reduces the chance that a developer forgets a check on one obscure endpoint.
2. Per-Request Enforcement
A user who was authorized to view Invoice #1001 should not automatically be allowed to view Invoice #1002 simply by changing a URL parameter. Each request must verify: Is this specific subject allowed this specific action on this specific object right now?
3. Server-Side Validation
Client-side checks (hiding a button, disabling a menu item, JavaScript validation) are convenience features, not security controls. Complete Mediation requires that the authoritative check occur on the server, where the attacker cannot alter it.
4. Revocation Awareness
If a user's role is downgraded, their account is disabled, or a token is revoked, the system must reflect that change promptly. Long-lived cached permissions or sessions that never re-evaluate authority violate the principle. Short token lifetimes, token introspection, and real-time policy lookups help address this.
5. Defense Against Alternate Paths
Mediation must cover APIs, batch jobs, admin consoles, mobile endpoints, legacy interfaces, and direct database access. If the web UI enforces authorization but the REST API does not, Complete Mediation has failed.
Examples of Violations
• An application checks permissions when rendering a page but not when processing the form submission.
• A file download endpoint accepts any filename without verifying ownership.
• An authorization result is cached for 24 hours even though the user was terminated an hour ago.
• An internal microservice trusts any call from inside the network without validating the caller's authority.
Relationship to Other Principles
• Least Privilege defines how much access a subject should have; Complete Mediation ensures that limit is actually enforced on every access.
• Fail-Safe Defaults says that when a check cannot be made, deny access; Complete Mediation says a check must always be made.
• Economy of Mechanism supports Complete Mediation by keeping the mediation component small and verifiable.
• Psychological Acceptability is the natural tension point: constant checking can hurt performance and usability, so designers must balance rigor with efficiency.
Exam Tips: Answering Questions on Complete Mediation
Tip 1 – Look for the keywords. Phrases such as "every access," "every time," "all requests," "non-bypassable," "always invoked," and "reference monitor" are strong signals that the correct answer is Complete Mediation.
Tip 2 – Distinguish it from Least Privilege. Students frequently confuse these two. If the scenario is about granting only the minimum permissions needed, the answer is Least Privilege. If the scenario is about a permission check being skipped, cached too long, or bypassed through an alternate path, the answer is Complete Mediation.
Tip 3 – Caching is the classic trap. The CSSLP exam loves scenarios where an application caches authorization decisions for performance and a user retains access after their rights were revoked. This is a textbook Complete Mediation violation. Be cautious of any answer that endorses long-lived permission caching as a "best practice."
Tip 4 – Client-side checks are never sufficient. If an option suggests that hiding a UI element or using JavaScript validation satisfies access control, eliminate it. The exam expects server-side enforcement on every request.
Tip 5 – Map vulnerabilities to the principle. IDOR, forced browsing, missing function-level access control, and privilege escalation are all consequences of failing Complete Mediation. If asked which design principle, when applied, would have prevented one of these, choose Complete Mediation.
Tip 6 – Know the Reference Monitor triad. Be ready to identify the three properties: tamper-proof, always invoked (Complete Mediation), and verifiable (small enough to analyze). Questions may ask which property Complete Mediation corresponds to; the answer is always invoked.
Tip 7 – Recognize the trade-off. If a question asks about the downside or challenge of Complete Mediation, the expected answer is performance overhead or usability friction, which is why designers sometimes resort to caching and must do so cautiously.
Tip 8 – Read for "once" versus "every." Any scenario where a check happens only at login, only at session start, or only on the first request is describing the absence of Complete Mediation. The remedy is to re-verify authority on each access.
Tip 9 – Think like a secure architect, not just a coder. CSSLP questions are often framed at the design or requirements level. The "best" answer typically involves a centralized, consistently applied authorization mechanism rather than ad hoc fixes to individual pages.
Quick Recap
Complete Mediation = check every access to every object, every time, through a non-bypassable mechanism. It is the "always invoked" property of the reference monitor, it is undermined by careless caching and client-side-only checks, and it is the design principle that prevents broken access control vulnerabilities. Master the distinction between how much access (Least Privilege) and whether access is verified each time (Complete Mediation), and you will handle these exam questions with confidence.
Unlock Premium Access
Certified Secure Software Lifecycle Professional
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3032 Superior-grade Certified Secure Software Lifecycle Professional practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CSSLP: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!