For a web app, we are authenticating and authorizing users. There is no Sign-up option, but rather these users are provisioned into the system explicitly and are given certain permissions based on their level.
Say a role has access to customer data. This access is required to conduct business processes during business hours, or say when that user has an appointment with a specific customer.
Is there any way that we can restrict (or reduce) the permission of a user based on certain criteria, e.g. they are using the web app on mobile, or it is outside business hours, or it is being accessed outside a set location?
I have come across this question where they suggest to use IP based restriction, or specific hardware devices with certificate installed. IP restriction could be enabled, but it does not solve the need to access on the go. Having specific hardware doesn't help if they provide full access on the go. I don't have much of a background in security, so any direction is appreciated.
Update From what everyone is suggesting, I will try to understand about Identity Aware Proxy which would handle dynamic generation of permission, or roll out something on the db side, or look at setting up logging. Thanks for sharing. I don't know which is the right answer.