Modernizing Authorization: From Basic Roles to Decoupled ABAC
summary
Claims that a decoupled authorization service replaces duplicated if/else checks across languages by centralizing RBAC and ABAC as YAML policies, implemented by Cerbos and its managed Cerbos Hub. It runs as a local sidecar, evaluates policies in-memory to a submillisecond decision of allow/deny, emits structured audit logs for SOC2/ISO needs, and scales statelessly so apps only call a simple API instead of reimplementing permissions in every service. policy-as-code
AI-written summary · about
chapters (18)
- 0:00intro
- 1:43preamble
- 2:52authn ≠ authz
- 4:05let's scale a company
- 4:16stage 1 - the blissful days of roles
- 4:58stage 2 - let's change our product packaging
- 6:07stage 3 - let's sell into another region
- 7:31stage 4 - let's sell to 'enterprise' organisations
- 8:55stage 5 - new ciso: let's get iso27001 / soc2
- 10:16stage 6 - we need microservices!
- 11:57a new approach
- 13:23authorizaion-as-a-service?
- 14:09code to policy
- 15:41rise of sidecars
- 16:52in practice
- 21:15advantages, challenges
- 24:16about cerbos
- 25:00thanks
related talks
42mBeyond Code: Shaping Security in a Developer-Driven World
32mImplementing Authorization
29mAuthz as a dev workflow
14mA Policy-as-Code Approach to RBAC Authorization
24mExpanding beyond authentication with emerging authorization standards
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
45mThe Future of Authorization in Applications
43mApplication Code of Conduct - Full-Stack Policy as Code