Authz as a dev workflow
summary
Argues that authorization belongs in the developer workflow as declarative policies backed by external decision points, not scattered imperative checks; shows concrete tools (OPA with Rego, OpenFGA/Zanzibar, Serbos YAML, OSEN interoperability) and cites Netflix’s decade-old move to decoupled auth and Google’s Zanzibar for global scale. Recommends authorization as a service with sidecar deploys to avoid latency, request context enrichment to push filtering into the auth layer, ABAC for fine-grain rules, and policy-driven testing for faster, safer deployments.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 2:24Authorization paradox explained
- 5:12Authorization workflows lag
- 8:42Constraint to creative tool
- 11:50Domain driven authorization
- 12:56Declarative policies
- 14:40External decision points
- 16:23Context aware authorization
- 17:47Modern authz tools
- 22:42Authorization as a service
- 23:45Sidecar deployment
- 24:48Defense in depth authz
- 25:53Policy driven design
- 26:34Request context testing
- 28:21Workflow integration & closing
related talks
32mAuthz as a Dev Workflow: Architecting Better Cloud Native Apps
45mThe Future of Authorization in Applications
42mBeyond Code: Shaping Security in a Developer-Driven World
24mExpanding beyond authentication with emerging authorization standards
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
25mModernizing Authorization: From Basic Roles to Decoupled ABAC
43mApplication Code of Conduct - Full-Stack Policy as Code
25mThe Root of Auth Thingz