A layer may call the layer below it and must never call the layer above. Enforcement calls identity; identity calls authorization; nothing calls back up to experience.
Telemetry is the bottom layer rather than a sidebar because every layer emits into it and none of them reads from it — that is exactly what a bottom layer is.
Governance and secrets sit above the resource plane deliberately: an entitlement decision is made before a resource is touched, never reconciled after.
The red arrow
One application resolves group membership from Microsoft Graph while serving a request. That turns a control-plane service into a runtime dependency on the hot path.
Mitigation is in flight: groups move into the token as a roles claim, with the Graph call kept as a cold fallback behind a 10-minute cache and a circuit breaker.
It is drawn rather than removed because a hidden violation is a defect, while a visible one is a decision with an owner and a date.
Assumptions
Group claims stay under the token size limit. Above roughly 150 groups Entra emits an overage claim and the application must call Graph anyway — which is why the group model is flat by policy.
Every application in the estate can consume OIDC or SAML. The residue goes behind Application Proxy or Entra Private Access rather than being granted a direct network path.
Application-level authorization is the product team's responsibility; the platform supplies roles, scopes and claims, not the product's own permission semantics.
