Expanding beyond authentication with emerging authorization standards
summary
Argues that externalized, runtime authorization (not just OAuth tokens) is required for fine‑grained, contextual decisions: a PEP talks to a PDP using attributes from a PIP and admin policies in a PAP (PEP PDP PIP PAP). Shows ABAC policies (example language released in 2014, Alpha policy language) that enforce dynamic segregation‑of‑duty (prevent approving your own PO), enable delegated banking access for caregivers, stop IDOR/API leaks flagged by OWASP, and integrate with zero‑trust continuous checks.
AI-written summary · about
chapters (15)
- 0:00Introduction and speaker intro
- 1:08Rats and authorization analogy
- 3:57Why externalized authorization matters
- 6:27OAuth limitations for fine-grained control
- 8:14Authorization standards and models
- 10:41Token vs runtime authorization
- 13:08ABAC architecture explained
- 14:32Attributes and policies in ABAC
- 15:55Broken access control risks
- 16:57Access delegation use cases
- 18:24User experience and authorization
- 19:47Authorization policy languages
- 21:31Authorization in zero trust
- 21:52Benefits of externalized authorization
- 23:15Q&A and panel preview
related talks
51mAuthorization beyond @RolesAllowed
45mThe Future of Authorization in Applications
29mAuthz as a dev workflow
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
32mImplementing Authorization
25mModernizing Authorization: From Basic Roles to Decoupled ABAC
29mGraph-Based Authorization: How to Secure Your API With Your Own Graph
30mAuthZEN in Practice: Standardizing Authorization for Cloud Native Platforms and Agents