Show Your Work: Governing an API Standard with ADRs and Attacker Models

This is the seventh post in my series on Germany’s federal API authorization blueprint. The last six posts walked the technology. This one is about the thing I think will outlast every specific technology choice in the project, the part that is genuinely the hardest to copy and the most valuable to try: how they made the decisions, and how they wrote them down.