フリー問題

問題文

A team lead argues that policies are unnecessary because the auth method already decides who may log in. What is the strongest counterargument in terms of what each mechanism actually decides?

選択肢

1. The auth method cannot be limited to a subset of users, so the policy is the only place where the set of allowed clients can be narrowed.
2. The auth method issues a token whose value can be guessed, so the policy is needed as a second factor that the holder must also supply when making a request.
3. The auth method is evaluated only once at login, whereas the policy is re-run against the external directory on every request, which keeps the decision fresh.
4. The auth method decides whether the client is who it claims to be, while the policy decides which paths and operations that client may use afterwards.