Dynamic decision engine for software authority to operate

A computer system for authorizing usage of software developed in an application management platform, the computer system comprising an electronic processor and a persistent non-transitory computer-readable medium comprising instructions that, when executed by the electronic processor, configure the electronic processor to perform actions comprising:

• obtaining, from the application management platform, risk qualification parameters for the software, wherein the application management platform comprises a computing environment that manages the development of a software product, wherein the application management platform allows a user to access and develop software on any of a plurality of virtual machines, wherein the risk quantification parameters comprise design time risk parameters obtained at a software security architecture/planning phase, and wherein the risk quantification parameters comprise build time risk parameters obtained at a continuous deployment pipeline phase;
• determining a risk qualification value from the risk qualification parameters;
• determining a risk qualification value from the risk qualification parameters;
• obtaining risk threshold parameters;
• determining a risk threshold value from the risk threshold parameters;
• comparing the risk qualification value to the risk threshold value to obtain an acceptability state for usage of the software;
• and
• performing an authority to operate action based on the acceptability state, wherein the authority to operate action comprises at least one of:
• authorizing release of the software upon a positive acceptability state, or instructing the application management platform to send an alert upon a negative acceptability state.