[efitz]

There is a lot of formal research on both authentication and authorization. IIRC Butler Lampson’s Turing Award was based on work he did in that area: https://amturing.acm.org/award_winners/lampson_1142421.cfm