Beyond Code: Shaping Security in a Developer-Driven World
summary
Argues that authorization belongs outside application code and shows a concrete migration: replace scattered if statements with policy-as-code YAML stored in Git, run by a sidecar authorization service, and return a single allow/deny boolean to the app. Demonstrates Cerbos integration and audit log generation, explains scaling across languages and regions, cites a real infra pain (repeated rewrites under changing requirements) and operational load (billions of requests) to justify the approach.
AI-written summary · about
chapters (20)
- 0:00Security in dev-driven world
- 1:53Security layers in modern systems
- 6:24Authorization and audit overlooked
- 9:34Scaling authorization with growth
- 10:35Early authorization with hardcoded roles
- 12:00Pricing tiers in authorization logic
- 13:49Regional data regulations like GDPR
- 15:56Enterprise fine-grained permissions
- 18:01Security certifications and compliance
- 19:48Audit logs for compliance
- 21:11Microservices authorization replication
- 23:20Centralized authorization service
- 26:05Policy-based authorization rules
- 27:50Sidecar authorization in Kubernetes
- 28:52Request flow in authorization system
- 33:03Simplify app code with single check
- 34:26Centralized auth benefits and challenges
- 36:31Developers and business security
- 36:52Auth solutions open source and commercial
- 37:36Q&A
related talks
25mModernizing Authorization: From Basic Roles to Decoupled ABAC
32mAuthz as a Dev Workflow: Architecting Better Cloud Native Apps
29mAuthz as a dev workflow
23mSecurity As Code - The New Model Of Achieving Security At Scale
43mApplication Code of Conduct - Full-Stack Policy as Code
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
23mSecure Your Systems the Better Way Using Policy-as-Code
59mSecurity as Code: A DevSecOps Approach