Process-Aware Contextual Access Control Framework Integrating Role-Based Authorization for Secure Information Systems

The rapid adoption of digital infrastructures, cloud computing environments, and distributed enterprise systems has significantly increased cyber threats targeting information systems. The increasing use of automated workflows, shared databases, and process APIs has become essential for modern enterprises, making access control a critical component of information-system security. Although automated workflows, shared databases, and API-oriented services improve operational efficiency, they also introduce significant security risks that require robust access-control mechanisms.

Insufficient access control can lead to privacy breaches, privilege abuse, process manipulation, data compromise, and operational disruption. Traditional security architectures primarily rely on perimeter-based protection and static permission models, making them vulnerable to modern attacks that exploit insider threats, compromised credentials, and privilege escalation.

Role-Based Access Control (RBAC) is one of the most popular authorization systems due to its ability to assign roles to users, which makes managing permissions for users easy.

However, traditional RBAC does not provide dynamic flexibility, situational awareness, and process-level authentication. Attackers can use static permissions through privilege escalation, session hijacking, or insider abuse.

Attribute-Based Access Control (ABAC) addresses some of these limitations by incorporating contextual attributes into access decisions; however, this increased flexibility is often accompanied by greater policy complexity and computational overhead.

Zero Trust Architecture (ZTA) deals with continuous verification but may not be based on well-organized RBAC. Business Process Management (BPM) systems improve workflow monitoring and execution but are generally not tightly integrated with authorization mechanisms.

A failure to adhere to the concept of integrating role-based authorization and process-driven security intelligence is one of the biggest scientific uncertainties. The existing models also focus on access control, authentication, encryption, and workflow validation as separate modules instead of being one of the components of the security architecture.

This fragmented design can result in inconsistent policy enforcement, delayed threat detection, and limited visibility across security operations. Although considerable progress has been made in RBAC, ABAC, ZTAs, and workflow-security frameworks, these approaches primarily address individual dimensions of system security rather than providing a unified authorization model.

Existing hybrid architectures generally combine role and contextual information but rarely incorporate workflow-state validation as a core component of access decisions. Moreover, encryption, continuous monitoring, and process validation are commonly implemented as supporting security services instead of being integrated directly into the authorization mechanism. Consequently, a unified framework capable of simultaneously evaluating user identity, assigned roles, contextual conditions, workflow state, and continuous security monitoring remains insufficiently explored in the current literature.

Secure Role-Based Information System (SRBIS) offers real-time, adaptive protection, which satisfies the needs of modern enterprises by combining formal access modelling, layered security controls, and dynamically analyzing threats.

Unlike conventional access-control approaches that primarily focus on static permission assignment or isolated attribute evaluation, SRBIS introduces a process-aware authorization mechanism that incorporates workflow states and contextual conditions into access decisions, enabling adaptive protection against privilege misuse, credential compromise, and context-dependent threats.

To address this research gap, this study proposes the SRBIS, an adaptive access-control architecture that integrates role-based authorization, contextual validation, workflow-state awareness, encrypted communication, and continuous monitoring into a unified security framework.

The primary novelty of SRBIS lies in the integration of process-state awareness with contextual and role-based authorization within a unified access decision mechanism.

Existing RBAC models primarily rely on predefined roles and permissions, while ABAC-based approaches extend authorization through environmental attributes but often lack explicit consideration of business workflow states.

Similarly, ZTAs emphasize continuous verification but generally operate at the identity and network-security level rather than incorporating process execution constraints into authorization decisions.

SRBIS addresses this limitation by introducing a process-aware adaptive authorization model in which access decisions are dynamically determined through the combined evaluation of user identity, assigned role, permission requirements, contextual conditions, and current workflow state.

Unlike conventional hybrid approaches that combine RBAC and ABAC attributes, SRBIS treats process state as an independent authorization factor, allowing the system to prevent legitimate users from performing unauthorized actions even when valid credentials and permissions exist. Therefore, the contribution of SRBIS is not merely the combination of existing security components but the development of a unified decision-making architecture that links role management, contextual risk evaluation, and workflow integrity into a single and adaptive authorization process.

To clarify the nature of this contribution, SRBIS should be understood as an integrated authorization decision mechanism rather than as a fundamentally new access-control theory.

The decision mechanism operates through sequential and conjunctive validation of five authorization dimensions: authenticated user identity, role and permission eligibility, contextual risk conditions, current workflow state, and policy constraints.

A request is authorized only when the role-permission requirements are satisfied, the contextual risk remains within the permitted threshold, and the requested operation is valid for the current workflow state.

Thus, the distinctive decision logic of SRBIS is the use of workflow state as an active authorization condition that can override otherwise valid role and permission assignments.

This mechanism enables SRBIS to distinguish between a user who is generally authorized to perform an operation and a user who is authorized to perform that operation under the specific contextual and process conditions prevailing at the time of the request.

Accordingly, the novelty claimed in this study concerns the integration and operationalization of this process-aware, context-aware decision mechanism within a unified enterprise security architecture, rather than the invention of new RBAC, ABAC, Zero Trust, or cryptographic primitives.

The main contributions of this study are as follows:

Process-aware adaptive authorization model: SRBIS introduces a unified access decision mechanism that extends traditional RBAC by incorporating workflow states as an additional authorization factor alongside roles, permissions, and contextual attributes.

Context-aware threat detection: SRBIS dynamically evaluates environmental and behavioral conditions, including device trust, network integrity, and session characteristics, to adjust authorization decisions according to real-time risk conditions.

Performance-efficient design: SRBIS demonstrates that process-aware and context-aware authorization can improve security resilience while maintaining acceptable computational overhead through layered security enforcement.

Better resilience of the enterprise: The framework offers adaptive security that improves resistance, responsiveness, and continuity of operation in distributed enterprise settings.

This combined solution shows obvious benefits compared to the classic RBAC and ABAC designs, which offer real-time and adaptive security that is viable and effective for modern enterprise systems.

The architecture is designed to improve security resilience while maintaining acceptable system performance. The solution is a blend of formal access modelling, layered architecture, and real-time threat monitoring to provide adaptive security of an enterprise environment.

The proposed framework demonstrates how integrating adaptive authorization with process intelligence can improve system resilience, threat detection, and response efficiency.

3.1 Formal access model

SRBIS extends the traditional RBAC model by integrating contextual validation and workflow-aware authorization into the access decision process, incorporating contextual access validation and process-aware authorization.

The distinctive aspect of the SRBIS model is that workflow state (T) is not treated as an operational monitoring parameter but as an active authorization factor. The SRBIS decision mechanism follows a conjunctive authorization logic in which role-based eligibility is necessary but not sufficient for access.

First, the system authenticates the requesting user and verifies the user's assigned role and requested permission. Second, the Context Analyzer evaluates runtime conditions and derives a contextual risk value from device trustworthiness, network integrity, session freshness, and related behavioral indicators. Third, the Process Management Controller verifies whether the requested operation is permitted in the current workflow state. The final authorization decision is therefore generated from the joint satisfaction of identity, role-permission, contextual-risk, and workflow-state conditions.

If any mandatory authorization condition fails, the request is denied or subjected to additional verification, even when the user possesses otherwise valid credentials and permissions.

This sequential-conjunctive mechanism constitutes the operationally distinctive feature of SRBIS because it makes process-state validity a mandatory part of authorization rather than an external workflow-monitoring function.

This enables the system to evaluate whether a requested action is permissible within the current process stage, even when the user possesses valid credentials and assigned permissions.

It is formally defined as the mechanism for access decisions.

$Access =f(U, R, P, C, T)$             (1)

where,

•U denotes the authenticated user identity;

•R represents the assigned role;

•P denotes the permission set;

•C represents contextual attributes;

•T denotes the current process state.

Importantly, the contextual risk score does not independently determine authorization. Instead, it functions as one decision input within the broader SRBIS authorization mechanism. A low contextual risk cannot compensate for an invalid role-permission assignment or an invalid workflow state, while a valid role and permission cannot compensate for a failed contextual or process-state condition.

The final decision therefore follows a mandatory multi-condition logic in which contextual risk operates as an adaptive constraint and workflow state operates as a process-integrity constraint. This distinction is central to the SRBIS contribution: the framework does not simply aggregate RBAC and ABAC characteristics, but establishes a decision sequence in which process-state validity is explicitly coupled with role, permission, and runtime-context validation before protected resources can be accessed.

Authorization is granted only after all variables meet the predetermined policy constraints. In contrast to traditional RBAC models that treat a large portion of credential validation as a statistical matter, the proposed algorithm dynamically assesses runtime conditions and workflow stages, thereby eliminating the concept of unauthorized operations when valid credentials are presented. Role hierarchy is defined as:

$R_i \geq R_j \Rightarrow \operatorname{Perm}\left(R_i\right) \supseteq \operatorname{Perm}\left(R_j\right)$              (2)

It is a setup that is hierarchical and allows transfer of the permissions of lower role positions, but at the same time, high enforcement of policies.

The contextual validation role is represented as:

$Cvalid = Dt \wedge N i \wedge S f$                  (3)

where,

•Dt denotes device trustworthiness;

•Ni denotes network integrity;

•Sf denotes session freshness.

The final authorization rule is:

$Grant \Leftrightarrow (Rolevalid\wedge Cvalid \wedge Pvalid)$                 (4)

The multi-factor decision mechanism ensures that authorization depends not only on user identity but also on contextual conditions and workflow status.

The proposed secure RBAC algorithm ensures that users are granted or denied access based on their authenticated roles and contextual evaluation, as illustrated in Figure 1.

1.png

Figure 1. Workflow of the proposed Secure Role-Based Information System (SRBIS) access-control algorithm showing identity authentication, role verification, contextual validation, workflow-state evaluation, and final authorization decision

3.2 System architecture

The proposed system architecture is a multi-layered, modular, and security-oriented framework comprising six integrated components that provide secure, context-aware, and process-aware access control.

This architecture does not use traditional access control systems that rely on credential verification as the primary approach; rather, it adopts a defense-in-depth paradigm in which authorization decisions are authenticated across a series of independent security levels before access to system resources is granted. The modules have their functional specialization while interacting with one another through secure interfaces, forming a resilient, fault-tolerant ecosystem that can withstand external and internal threats.

This module authenticates users using multi-factor authentication (MFA), cryptographic credentials, and secure session validation. In addition to determining access permission, a successful authorization decision activates the cryptographic service responsible for secure data retrieval.

Consequently, access approval and data decryption are sequential operations within the same security workflow, preventing encrypted information from being exposed to unauthorized users even if storage media or communication channels are compromised.

3.2.1 Identity and authentication module

This module is the primary access point for any access request and authenticates user identities using MFA settings.

It combines password-based authentication, one-time authentication, biometric authentication, and cryptographic authentication keys to guarantee high identity assurance.

The token validation schemes recognize the authenticity of a session and eliminate replay and impersonation attacks.

This module also manages the session lifecycle, e.g., token expiration, renewal, and revocation, so that only authenticated and authorized users can initiate the system. The authentication module was implemented using the OAuth 2.0 authorization framework with JSON Web Tokens (JWT) for stateless session management.

User credentials were verified through encrypted password hashes using the BCrypt algorithm, after which a signed JWT containing user identity, assigned roles, and session metadata was generated. MFA required successful password verification followed by a one-time authentication code before an access token was issued. Session expiration, token renewal, and token revocation were managed automatically through server-side validation.

3.2.2 Role and Policy Engine

The Role and Policy Engine is the central point of decision-making in the architecture. It enforces a hierarchy of roles, permission mappings, and policy rule sets, allowing authorized operations for each type of user.

This sub-module is a dynamic component that authorizes requests through user role authentication, compares the user role against the associated privileges, and applies policy constraints such as separation of duties, least privilege, and role inheritance.

Real-time updates on policies are also supported by the engine so that administrators can modify access rules without influencing the work of the system and make the system more dynamic and effective for administration.

Authorization policies were stored in relational policy tables within PostgreSQL. Each incoming request triggered a policy evaluation that matched the authenticated user role with the requested resource and operation.

The policy engine further enforced least-privilege constraints, role inheritance, and separation-of-duty rules before generating an authorization decision.

Policy evaluation required only indexed database lookups, resulting in low computational overhead during runtime.

3.2.3 Context Analyzer

The Context Analyzer is one of the systems that adds environmental and situational awareness to the authorization decisions to facilitate better system security.

It keeps analyzing the geographic position of the device, fingerprints, context information, IP reputation ratings, behavior during the session, and behavioral irregularities.

Once these parameters have been analyzed, the system is able to identify suspicious activity, including an attempt to log in with an unknown device or at an odd time.

It intervenes by instigating further checks or denying connections.

This contextual analysis transforms static authorization into an adaptive decision process capable of responding to changing security conditions.

Consequently, the system will guard against loss of data, integrity of business logic, and consistency in operations as well. As illustrated in Figure 2, the Context Analyzer workflow demonstrates these processes and their interactions.

2.png

Figure 2. Operational workflow of the Context Analyzer illustrating device verification, IP reputation analysis, behavioral assessment, contextual risk calculation, and adaptive access decision

Contextual validation was performed by evaluating four runtime attributes: (i) registered device fingerprint, (ii) network trust level based on IP reputation and Transport Layer Security (TLS) session integrity, (iii) login time and geographical consistency with previous sessions, and (iv) behavioral indicators including repeated authentication failures and abnormal access frequency. Each attribute contributed to a weighted contextual risk score ranging from 0 to 100. Requests exceeding the predefined security threshold triggered additional authentication or were rejected automatically.

3.2.4 Encryption Layer

The Encryption Layer provides data confidentiality and integrity across all system operations. Unlike conventional architectures where encryption operates independently of authorization, the proposed SRBIS integrates cryptographic protection directly into the access-control workflow.

Data decryption is performed only after successful completion of identity authentication, role verification, contextual validation, and workflow-state confirmation. Consequently, encryption functions as an additional enforcement layer within the authorization process rather than as an isolated security mechanism.

Following successful authorization by the Role and Policy Engine, the Encryption Layer retrieves the appropriate cryptographic key to decrypt only the specific data resources permitted by the approved access policy.

If authentication or contextual verification fails at any stage, decryption is not initiated and encrypted data remain inaccessible. This design ensures that cryptographic protection and access-control decisions operate as a unified security mechanism. It secures the stored and transmitted information with advanced cryptographic algorithms, secure key management protocols, and encrypted communication channels. Strong symmetric encryption is used to secure data at rest, and secure transport protocols are used to secure data in transit, ensuring it cannot be intercepted or tampered with. The overall workflow of the Encryption Layer is illustrated in Figure 3. Data stored in PostgreSQL was encrypted using Advanced Encryption Standard (AES)-256 symmetric encryption before persistence. Cryptographic keys were securely managed using protected server-side key storage and were never transmitted to clients.

3.png

Figure 3. Integrated encryption workflow demonstrating secure key management, Advanced Encryption Standard (AES)-256 data encryption, Transport Layer Security (TLS) 1.3 communication, and cryptographic protection during the Secure Role-Based Information System (SRBIS) authorization process

Communication between clients and the application server employed TLS 1.3 with ephemeral session keys to guarantee confidentiality and forward secrecy during data transmission.

3.2.5 Process Management Controller

This part brings workflow awareness to the access control mechanism. It tracks the state changes of the processes and confirms the legitimacy of the requested actions of the right workflow phases.

Although a user may possess valid credentials and permissions, access is denied if the requested operation violates workflow constraints or falls outside the authorized execution stage.

Process-aware validation ensures that authorized users perform only those actions permitted within the current workflow stage, thereby protecting business-process integrity.

As a result, the system also protects against data loss, the integrity of business logic, and operational consistency.

3.2.6 Audit and Logging Module

The Audit and Logging Module offers much control and insight into what is occurring in the system.

It records authentication events, authorization decisions, policy updates, system anomalies, and user activities in tamper-resistant audit logs.

These records can be used to conduct forensic investigations, accountability allocation, incident response, and security investigations.

The module also has automated alert systems that inform administrators in real-time about suspicious or policy-violating activity to quickly identify and prevent any possible threat.

3.2.7 Security paradigm in architecture

The overall design is a layered validation, where each layer is allowed to validate certain security requirements prior to passing a request to the subsequent layer.

Access is granted after all the modules have confirmed that the identity, role permission, contextual requirements, cryptographic integrity, process legitimacy, and audit requirements have been satisfied.

This distributed verification model eliminates single points of failure and enhances system resilience against complex threats, including privilege escalation, session hijacking, insider misuse, and advanced persistent threats (APTs).

The stepwise authorization flow is as follows:

Identity module: checks user credentials and identity of the requester;

Policy engine: compares the roles and permissions of the user with the access policies;

Context Analyzer: verifies the context, such as device fingerprint, location, time, and behavior patterns;

Process controller: verifies the validity of the process requested, confirms that the workflow is correct, and keeps audit trails;

Access decision: after all the modules have passed their verification, access is denied or granted based on the aggregate verification.

The sequential architecture should not be interpreted as a simple collection of independent security modules. Its distinguishing feature is the dependency among the authorization stages: the output of each validation stage becomes a prerequisite for the subsequent decision stage.

In particular, workflow-state validation is coupled with role-permission and contextual validation rather than being performed only for monitoring or auditing purposes.

Consequently, a request that satisfies identity and role requirements can still be rejected when its contextual risk exceeds the permitted threshold or when the requested operation is inconsistent with the current process state.

This dependency transforms workflow awareness from a supporting security function into an enforceable authorization condition.

Figure 4 shows the layered security paradigm and the sequential discussions between these modules when authorizing a request.

4.png

Figure 4. Layered Secure Role-Based Information System (SRBIS) security architecture illustrating sequential validation across authentication, policy evaluation, contextual analysis, workflow verification, encryption, and audit logging modules

3.3 Technical implementation

The SRBIS prototype was implemented using a client–server architecture. The backend application was developed using Python, while PostgreSQL served as the relational database management system.

User authentication was implemented through OAuth 2.0 with JWT, and passwords were protected using BCrypt hashing.

AES-256 encryption secured sensitive information stored in the database, whereas TLS 1.3 protected all client–server communication.

Access-control policies were evaluated dynamically through PostgreSQL policy tables containing role assignments, permissions, contextual constraints, and workflow-state rules.

The Context Analyzer continuously evaluated runtime attributes including device fingerprint, IP reputation, session freshness, geographical consistency, and behavioral anomalies before calculating a contextual risk score.

Workflow validation was implemented through predefined process-state transition rules enforced before every protected operation.

Security events were recorded within tamper-resistant audit logs and analyzed continuously to support anomaly detection and incident response.

3.4 Evaluation methods

The integrated evaluation strategy was designed to simulate realistic operational environments while enabling a systematic comparison with conventional access-control architectures.

All the evaluation methods consider a different aspect of system reliability. As such, it is ensured that inferences about effectiveness and efficiency are both scientifically and practically sound.

3.4.1 Penetration testing

Controlled penetration testing was performed using a predefined attack framework designed to simulate realistic enterprise cyber threats.

Four representative attack categories credential theft, session hijacking, privilege escalation, and insider unauthorized operations – were executed against both the baseline RBAC implementation and the proposed SRBIS framework.

Each attack scenario consisted of 100 independent attack attempts under identical system configurations. Successful attacks were recorded when unauthorized access or unauthorized process execution was achieved. All experiments were repeated ten times to minimize random variation and improve statistical reliability.

The evaluation included multiple attack vectors, including credential spoofing, privilege escalation, session hijacking, and injection-based attacks, executed within a controlled testing environment.

This method allowed direct assessment of the system defense power, its resistance to attacks, and the performance of the anomaly detection.

3.4.2 STRIDE-based threat modeling

Threat modeling was performed systematically, with the help of the STRIDE framework (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege): it was possible to systematically identify the possible vulnerabilities in different architectural layers through the use of the framework.

All the system modules were taken into consideration to identify the potential attack surfaces, threat probability, and the impact that will be incurred. Unlike a conventional STRIDE checklist, the proposed evaluation assessed the relative security risk associated with each threat category before and after implementation of SRBIS.

This analytical assessment enabled identification of the threats that benefited most from contextual validation, workflow-state verification, and adaptive authorization while also highlighting residual risks requiring complementary security controls.

The expanded attack evaluation demonstrates that SRBIS provides protection across multiple categories of security threats rather than only identity-based attacks.

Authentication attacks, privilege abuse, replay attacks, database attacks, and unauthorized API requests were successfully prevented through the combined operation of contextual validation, policy enforcement, encrypted communication, and workflow-state verification.

Table 3 summarizes the threats identified, the modules/components evaluated, possible vulnerabilities, and the mitigation measures.

Table 3. STRIDE threat modeling results and mitigation strategies for SRBIS

Note: MFA = multi-factor authentication, JWT = JSON Web Tokens, AES = Advanced Encryption Standard, TLS = Transport Layer Security, SRBIS = Secure Role-Based Information System, STRIDE = Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Although request throttling reduced the impact of Denial-of-Service attacks, complete mitigation of large-scale network flooding remains dependent on complementary infrastructure-level security mechanisms such as firewalls and load balancers.

3.4.3 Performance benchmarking

A performance test under controlled workloads was conducted to assess computational efficiency, scaling, and responsiveness [37].

Benchmarking experiments were performed to determine the latency, as well as throughput and processing stability, when the load of the requests was variable and when the users were operating simultaneously.

Stress tests were also done to determine the behavior of the system when operating at peak conditions.

Such experiments validated the existence or nonexistence of overheads in performance due to the additional security measures and the acceptable overheads within the functionality boundaries of deployment on a large scale.

Performance evaluation was conducted under controlled laboratory conditions to ensure repeatability and consistency. The prototype was deployed on a workstation equipped with an Intel Core i7 processor (3.40 GHz), 16 GB RAM, and Ubuntu 22.04 LTS.

The application server was implemented using Python 3.11 with the Flask framework, while PostgreSQL 15 was used as the backend database. The workload consisted of 200 simulated users distributed across 12 organizational roles.

During each experiment, between 50 and 200 concurrent users generated authentication and authorization requests with varying workflow states. Each workload execution lasted 30 minutes, during which approximately 25,000 access requests were processed.

Network latency was maintained below 5 ms to minimize external communication effects. Every experiment was independently repeated 10 times, and the reported results represent the arithmetic mean and standard deviation.

3.4.4 Statistical comparative analysis

To determine the statistical validity of the results of the proposed model, quantitative results of the testing were compared on the basis of comparative statistical methods.

The adoption of the performance and security indicators on the SRBIS was systematically compared to that of a conventional RBAC system in the identical experimental conditions.

Statistical analysis was performed using descriptive statistics and comparative performance evaluation. For each metric, the arithmetic mean and standard deviation were calculated across ten independent experimental repetitions.

Percentage improvements were computed relative to the baseline RBAC implementation under identical workload conditions. The consistently low standard deviation values demonstrate that the observed improvements were reproducible and were not attributable to random experimental variation.

3.4.5 Combined narrative of evaluation

In this section, the overall assessment and evaluation narrative of the project is presented. This section presents the aggregate story of assessment in the project and the aggregate assessment of the project.

The evaluation methodology provides a robust empirical framework by combining penetration testing, threat modeling, performance benchmarking, and statistical validation. The multi-method evaluation strategy improves the reliability, reproducibility, and credibility of the experimental findings.

It also agrees with the best practice of sound system validation, i.e., it proves that the proposed architecture is not just theoretically sound but also operationally verified and statistically justified to be implemented in the sound system.

3.5 Evaluation metrics

An extensive set of quantitative performance and security metrics was used to test the efficiency, strength, and business sustainability of the proposed SRBIS.

They have also implemented these measures with a keen consideration of ensuring that it is a multi-dimensional assessment, i.e., threat resistance, detection capability, response efficiency, and system performance.

Their combination offers a consistent and objective foundation on which the suggested structure can be compared to the conventional access control models.

3.5.1 Attack Success Rate

Attack Success Rate (ASR): The proportion of attempted intrusions that have been performed by simulation and have been successful in defeating the system defense mechanisms.

It can be construed as a direct measure of security, that is, the ability of a system to withstand unauthorized access, privilege escalation, and abuse of policies.

When the ASR values increase, it shows that there is more defense and authorization restrictions are in place.

3.5.2 Mean Time to Detect

Mean Time to Detect (MTTD) refers to the time that the system needs to detect any malicious activity or policy anomalies once they have occurred.

The indicator is a measure of the promptness of monitoring and detection systems. A smaller MTTD gives a better idea of danger, and the system can detect any suspicious activity at an early stage before it can really cause great damage.

3.5.3 Mean Time to Respond

Mean Time to Respond (MTTR) is an indicator of the average duration of the appropriate initiation and achievement of a suitable response to a detected threat.

It is a measure of efficiency in automated mitigation controls, incident response procedures, and notifications. The lower the values of the MTTR are, the more operational preparedness and capacity to contain.

3.5.4 Latency (milliseconds)

Latency is a concept that is applied in order to calculate the mean time of the system in responding to an access request submitted and a response given on the authorization. This measure computes computational efficiency and responsiveness.

Low-latency maintenance is the major factor to consider to make sure security enhancement does not affect the system usability and productivity. Throughput is the number of authorization or system requests that are being completed per second with load changes.

It is the ability of the system to scale and the ability to accommodate multiple users or transactions without compromising system performance. The increase in throughput values proves the capacity of the framework to contribute to massive deployments and regular work.

3.5.5 Combined evaluation perspective

It is also possible to conduct a combination of the two estimations, but the outcome of prioritizing one or the other should be considered. The analysis combines defensive and operational indicators, eliminating the constraints of single-metric evaluation strategies and enabling a realistic evaluation of system behavior under real deployment conditions.

The proposed architecture can be defined as secure in theory and efficient, scalable, and reliable in practice due to this multidimensional evaluation strategy.

The overall evaluation of the SRBIS demonstrates the effectiveness of integrating contextual validation and process-aware access control within conventional RBAC frameworks.

In each of the four simulated attack scenarios, which included credential theft, session hijacking, privilege escalation, and insider unauthorized operations, SRBIS prevented all unauthorized access attempts, achieving a 100% reduction in the ASR.

This finding highlights the effectiveness of the SRBIS multi-factor authorization mechanism, which evaluates user identity, assigned roles, contextual attributes, and workflow state before granting access.

These results further clarify the specific nature of the SRBIS contribution. The observed security improvement does not arise from introducing a new cryptographic primitive or replacing established RBAC, ABAC, or Zero Trust principles.

Rather, it results from making workflow-state validity and contextual risk explicit constraints on the authorization decision. In this sense, SRBIS extends the practical decision scope of role-based authorization by requiring the requested action to be simultaneously permissible for the user, acceptable under current contextual conditions, and legitimate within the active workflow state.

Performance analysis indicates that the additional security mechanisms introduce only a modest computational overhead, with a 7% increase in latency and a 5% reduction in throughput. Besides, SRBIS decreased MTTD and MTTR by 63 percent and 60 percent, respectively, demonstrating that access control can be dynamic and multi-dimensional and can significantly contribute to the promptness and reliability of security incident response.

The STRIDE-based risk analysis further demonstrates that the proposed architecture provides the greatest security improvement against identity-centric attacks, including spoofing and privilege escalation, while maintaining moderate residual risk for availability-related threats.

This result confirms that SRBIS primarily strengthens adaptive authorization rather than replacing conventional network-security mechanisms.

5.1 Comparison analysis

The findings of this study are consistent with and extend recent research on advanced access-control technologies. An important contribution of SRBIS is the integration of encryption into the authorization workflow.

The novelty of SRBIS should therefore be interpreted at the architectural and decision-mechanism level rather than as the introduction of a new access-control paradigm.

RBAC, contextual authorization, Zero Trust principles, workflow protection, and encryption remain established security concepts. The contribution of SRBIS is to operationalize these concepts through a unified authorization sequence in which role and permission eligibility, contextual risk, and workflow-state validity jointly constrain access.

In particular, the explicit treatment of workflow state as a mandatory authorization factor differentiates the proposed mechanism from architectures in which workflow monitoring is separated from the authorization engine. This distinction provides the main conceptual and practical contribution of SRBIS while avoiding an unsupported claim of a fundamentally new access-control theory.

Unlike conventional security architectures where encryption simply protects stored or transmitted information, SRBIS performs cryptographic operations only after successful adaptive access-control decisions.

This coupling strengthens confidentiality because encrypted resources remain inaccessible even when authentication credentials are compromised, but contextual or workflow validation fails.

The current body of knowledge on RBAC, ABAC, and ZTA demonstrates that context-aware and attribute-based decision-making can enhance system security.

The majority of current models, though, focus either on identity or contextual attributes, without an understanding of workflow or process state. To address this gap, SRBIS aims to combine role hierarchy, contextual analysis, and process validation under one roof.

As demonstrated by the comparative analysis, such a hybrid solution is more efficient than classical RBAC and ABAC implementations, particularly in the dynamic threat context.

Compared to conventional models, where one can access credential compromise or session hijacking to a certain degree, SRBIS does not support these types of violations because it enforces policy constraints, i.e., runtime environment validation and workflow stage validation.

The results contribute to the growing literature that encourages adaptive and multi-factor access control systems within distributed and cloud-based systems. Beyond the experimental comparison with traditional RBAC, the proposed SRBIS architecture was analytically compared with representative ABAC, Zero Trust, and hybrid RBAC–ABAC approaches described in the literature.

ABAC improves authorization flexibility by evaluating environmental attributes but does not explicitly consider workflow execution states during access decisions. ZTAs provide continuous verification and identity validation but primarily focus on network and identity security rather than process-level authorization.

Hybrid RBAC-ABAC models combine roles and attributes to improve adaptability; however, workflow-state evaluation is generally treated as an external process-management function rather than an integral component of the authorization mechanism.

SRBIS extends these approaches by introducing workflow-state validation as an independent authorization factor alongside user identity, assigned roles, permissions, and contextual conditions. Consequently, access decisions are dynamically adapted not only to the user's identity and environment but also to the operational status of the protected business process.

This integrated decision model improves resistance against insider misuse, privilege escalation, and process manipulation while preserving administrative simplicity through hierarchical role management.

5.2 Security/performance trade-off analysis

Implementation of the SRBIS implies a minor computational cost because it involves real-time evaluation of the situation and process status.

This has added 7% latency and 5% throughput, or the additional processing required for multi-factor authorization.

However, the system is characterized by high ASR and MTTD and MTTR values, which demonstrates that the security value is much more than the minor cost of operations.

Based on the observed security-performance trade-off, SRBIS appears to be a promising candidate for environments where data integrity and workflow protection are critical.

Nevertheless, additional validation under production-scale workloads and heterogeneous enterprise infrastructures is necessary before recommending large-scale operational deployment. For many enterprise applications, this level of performance overhead is acceptable considering the substantial improvements in security and operational resilience.

The layered design of SRBIS is also such that there exists no single point of bottlenecking modules to facilitate scalability and resilience of the operational environment when it is actually operating. The reported standard deviations remained consistently low across all performance metrics, indicating stable behavior of the proposed framework during repeated experimental execution.

This statistical consistency suggests that the observed improvements in attack resistance, threat detection, and response efficiency were reproducible under identical workload conditions.

Furthermore, the controlled workload configuration demonstrates that the modest increases in latency and reductions in throughput remained within acceptable operational limits for enterprise information systems.

5.3 Theoretical implications

The paper supports the theoretical argument that multi-dimensional access control systems that incorporate identity, context, and process-state awareness provide better security than traditional RBAC systems that lack dynamic awareness.

This study will add a new framework to the academic literature by formalizing, empirically proving, and testing the SRBIS access model.

As shown in the model, the adaptive authorization decision is made possible by dynamic analysis of both contextual and workflow parameters, which continues to gain relevance in the study of Zero Trust and hybrid access control.

Moreover, the theoretical implications can be extended to the design of future information systems. The identity-based paradigm is replaced with a more complex threat-detection and mitigation strategy through context- and operation-based security, achieved by incorporating process-aware access evaluation.

The strategy prepares scalable, malleable, and robust security structures for complex business setups.

5.4 Practical recommendations for implementation

Based on the empirical findings, several practical recommendations can be made for organizations seeking to enhance their access-control systems using SRBIS.

The empirical data on the implementation of the SRBIS can be used to offer practical recommendations on the companies that need to be equipped with the improved access control systems.

SRBIS may be integrated with the existing Identity and Access Management (IAM) systems, and it provides an additional layer of security without having to restructure the infrastructure completely.

Organizations have to incorporate real-time device trust, network integrity, and session freshness that dynamically inspect access requests. The business processes have to be designed with process-state validations such that a user cannot perform operations that she cannot perform at her current stage of workflow. Wide logging of access attacks, policy review, and anomalies are useful to meet the regulations, forensic investigation, and constant system improvement.

Security policies should be updated frequently in response to new threats, business process changes, or policy modifications to the demands of user roles or situations.

5.5 Research limitations

Despite the positive results of the study, it has certain weaknesses as well. It was conducted in an experimental lab setting and in simulated attack conditions.

Although the evaluation covered multiple representative cyber-attack scenarios, future work should include large-scale penetration testing involving distributed denial-of-service attacks, APT, ransomware simulations, and cloud-native attack environments to further validate the robustness of the proposed framework under real operational conditions.

Although the experimental configuration was designed to emulate enterprise operating conditions, the attack scenarios were executed within a controlled laboratory environment. Consequently, the reported security performance should be interpreted as prototype-level validation.

Additional evaluation using real organizational infrastructures and larger-scale deployments is required to further confirm the generalizability of the reported findings.

Real-world deployment environments may introduce additional complexities that require further investigation. SRBIS demonstrated reliable performance under moderate workloads; however, large-scale deployments involving thousands of concurrent users may require additional optimization and distributed processing techniques.

In addition, the present evaluation was performed using a prototype implementation within a controlled laboratory environment. Consequently, the reported performance and security improvements should be interpreted as proof-of-concept validation rather than evidence of production-scale effectiveness. Future work will include deployment within real organizational infrastructures, cloud-native environments, and geographically distributed enterprise systems to further evaluate scalability, reliability, and operational robustness.

The dynamically updated context evaluation and workflow validation rules within the system might be needed to ensure that mitigation of the assessed scenarios is effortless. In conclusion, it is clear that SRBIS is a robust multi-factor access control system that can considerably raise the level of security without affecting performance.

By adding identity, context, and process-state evaluation, SRBIS is better than the classic RBAC system and offers a practical, theoretically based solution to contemporary, sensitive, and distributed information systems.

The adaptive evaluation system and multi-layered architecture also provide resilience in the face of attacks and efficiency in the operation of the system, which makes them suitable to be deployed at the enterprise level.

Moreover, the acquired knowledge in this research applies in subsequent research on a hybrid access control model and process-understanding cyber security plan.