Cloud Enterprise Security Through Access Control and Audit Mechanisms: A Closed-Loop, Audit-Driven Access Governance Architecture

Abstract

Enterprises running cloud-based systems routinely implement access control through role-based or attribute-based policies, an approach the information-security literature has studied for decades [1][2], and they routinely generate audit logs recording who accessed what and when. In most deployed systems, however, these two mechanisms operate largely independently: access decisions are made by a policy engine working from a role or attribute model fixed at some prior point in time, while the audit log is written, stored, and reviewed as a separate, after-the-fact record whose own integrity is rarely cryptographically guaranteed, a gap Schneier and Kelsey's [3] foundational analysis of secure audit logs documents as a structural weakness rather than an implementation oversight. This separation means that anomalous access the kind of behavior that insider-threat detection research documents as both detectable in principle and routinely detected too late in practice [4][5] is typically discovered only when a periodic, manual audit review happens to catch it, well after the access has already occurred, and the evidentiary record of that access can itself be questioned if the audit log was not built to resist tampering. This paper proposes AEGIS (Access-control Event Governance and Integrity System), an architecture in which access-control enforcement and audit logging are not separate concerns but a single closed loop: every access decision is written into a tamper-evident, hash-chained audit ledger as it is made, a continuous anomaly and risk-scoring module reads that ledger on an ongoing basis rather than periodically, and the risk scores it produces feed directly back into the access-control policy engine's future decisions. Following a design-science research approach, AEGIS is illustrated, not empirically validated, through a comparative capability table, an illustrative case scenario, and two illustrative figures, with every quantitative value explicitly labeled as an illustrative estimate rather than measured production data. The paper situates AEGIS against the literature on role- and attribute-based access control, zero trust architecture, tamper-evident audit logging, cloud accountability frameworks, anomaly-based insider-threat detection, and regulatory audit obligations.