Authorization beyond @RolesAllowed
summary
Explains a practical authorization architecture with PEP PDP PIP separation, concrete limits like a 10 millisecond decision budget, and the need for a separate authorization service that owns a replicated read model. Shows concrete problems and solutions: teacher grading scopes tied to class membership, home-care nurses getting timebound patient access via a “give me access” flow with extra audit, Spring Security pre/post filters as enforcement, and industry options such as Zanzibar / SpiceDB for scalable relationship-based checks.
AI-written summary · about
chapters (15)
- 0:00Introduction to authorization
- 10:31What is authorization?
- 14:35Authorization models overview
- 17:08Policy enforcement points
- 20:09Policy decision points
- 21:59Policy administration points
- 25:00Policy information points
- 30:44Governance in authorization
- 33:13Advanced authorization models
- 35:05Practical examples in education
- 38:44Healthcare authorization case
- 42:18Implementing authorization
- 45:12Crosscutting concerns
- 47:17Performance considerations
- 48:45Wrap-up and Zanzibar
related talks
24mExpanding beyond authentication with emerging authorization standards
50mAuthorization in Spring Security: permissions, roles and beyond
02h 38mAuthorization with Spring Security: Permissions, Roles and More
16mAccess Granted with AuthZed
44mSecuring RAG Pipelines with Fine Grained Authorization
45mThe Future of Authorization in Applications
25mThe right feature at the right place: the example of authorization
30mAuthZEN in Practice: Standardizing Authorization for Cloud Native Platforms and Agents