###### Abstract  
In the evolving landscape of complex business ecosystems and their digital platforms, an increasing number of business Application Programming Interfaces (APIs) are encountering challenges in ensuring optimal authorization control. This challenge arises due to factors such as programming errors, improper configurations, and sub-optimal business processes. While security departments have exhibited proficiency in identifying vulnerabilities and mitigating certain viral or adversarial incursions, the safeguarding of comprehensive business processes remains an intricate task. This paper introduces a novel paradigm, denoted as the Low-Intervention Security Embedding Architecture (LiSEA), which empowers business applications to enhance the security of their processes through judicious intervention within business APIs. By strategically incorporating pre- and post-intervention checkpoints, we devise a finely grained access control model that meticulously assesses both the intent of incoming business requests and the outcomes of corresponding responses. Importantly, these advancements are seamlessly integrated into the existing business codebase. Our implementation demonstrates the effectiveness of LiSEA, as it adeptly addresses eight out of the ten critical vulnerabilities enumerated in the OWASP API Security Top 10. Notably, when the number of threads is less than 200, LiSEA brings less than 20 msec of latency to the business process, which is significantly less than the microservice security agent based on the API gateway. LiSEA; business security; architecture; API; access control +
Footnote †: journal: Applied  
This assertion finds resonance in the OWASP Security API Top 10 [7], wherein deficiencies in user authentication, object authorization, and functional access control mechanisms can potentially facilitate unauthorized user encroachments into business data, devoid of explicit attack vectors or payloads [8]. Furthermore, instances of immoderate data exposure or erroneous security configurations possess the capacity to engender inadvertent leakage of sensitive information [9]. Security departments today face a multifaceted responsibility that transcends the conventional realm of safeguarding against external network-borne viruses and external attacks. A paramount challenge in this domain resides in the imperative to meticulously oversee and substantiate the congruence of business operations with meticulously crafted architectural frameworks across an extensive spectrum of intricate scenarios. This challenge is notably pronounced in contexts featuring users endowed with legitimate authority. LiSEA represents an innovative architectural paradigm underpinned by the ZERO TRUST framework [9], aimed at securing business processes. LiSEA provides a client Software Development Kit (SDK) tailored for integration within the business system. This SDK seamlessly incorporates the business APIs and LiSEA, thereby imbuing them with inherent security considerations. Consequently, the architecture empowers precise scrutiny and adjudication of requests and responses emanating from these business APIs. The underpinning tenet of LiSEA resides in the contextual richness of security assessments, derived from the meticulous collection and transmission of intricate business contexts via the client SDK. Importantly, this security enhancement operates harmoniously alongside the underlying business system, exerting minimal disruption. In tandem with the architectural innovation, LiSEA introduces a bespoke business security operational framework. This framework is orchestrated through a fusion of risk modeling, business modeling, and Access Control Lists (ACLs) [10; 11]. This orchestrated synergy engenders an ecosystem capable of perpetuating continuous security operations, effectively combating both known and unknown business security problems. The cohesive orchestration of LiSEA's components presents a promising trajectory for elevating the resilience and robustness of business process security.