Your Cheat Code for API Authorization
summary
Explains how to turn an OpenAPI spec into a fine‑grained authorization model by importing endpoints into a Zanzibar-style directory, writing Rego policies, and pushing them to edge authorizers; demo shows Zupo API Gateway calling the authorizer to return 200 or 403, then granting Morty delete rights in real time and immediately getting a 200 (and revoking it back to 403); covers Zanzibar ReBAC model, policy as code, deployment as sidecars or local services with under millisecond authorization and centralized decision logs.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:51Authentication vs Authorization
- 4:15Traditional Authorization
- 8:40Policy Based Access Control
- 10:00RealTime Access Check
- 11:47State of the Ecosystem
- 14:28Enforcement Points
- 23:26Principles
- 24:38Schedule
- 25:19Questions
related talks
25mThe right feature at the right place: the example of authorization
29mAuthz as a dev workflow
16mAccess Granted with AuthZed
44mSecuring RAG Pipelines with Fine Grained Authorization
30mAuthZEN in Practice: Standardizing Authorization for Cloud Native Platforms and Agents
29mHow Google Built a Consistent, Global Authorization System with Zanzibar
25mMake Your Security Policy Auditable
15mFrom OpenID Connect to OpenID AuthZEN