Question 1

What is Darwan?

Accepted Answer

Darwan is an authorization and compliance API that provides role-based access control (RBAC), attribute-based policies (ABAC), separation of duties constraints, periodic access reviews, and immutable audit trails for multi-tenant applications.

Question 2

What compliance frameworks does Darwan support?

Accepted Answer

Darwan provides controls required by SOX (Sarbanes-Oxley), SOC 2 Type II, ISO 27001, HIPAA, PCI DSS v4.0, GDPR, and NIST 800-53 including separation of duties, access reviews, immutable audit logs, and time-bound assignments.

Question 3

How does Darwan handle audit trail integrity?

Accepted Answer

Every authorization decision is logged with a SHA-256 hash chain and per-tenant sequencing. Each event's hash includes the previous event's hash, making tampering detectable. Audit events are archived rather than deleted, preserving the full chain for compliance verification.

Question 4

What is Separation of Duties in Darwan?

Accepted Answer

Darwan's SoD constraints prevent conflicting roles from being assigned to the same principal. Constraints can be set to Block (reject the assignment with 409) or Warn (allow with a warning). Validation checks both direct principal-role and indirect group-role paths.

Question 5

How do access reviews work in Darwan?

Accepted Answer

Create periodic access review campaigns that generate review items for every current role assignment. Reviewers approve or revoke each item. Revoked assignments are deleted immediately. Overdue reviews auto-expire. This satisfies SOX, SOC 2, ISO 27001, and PCI DSS review requirements.

Welcome to Darwan