Authz as a Dev Workflow: Architecting Better Cloud Native Apps
Talkat KubeCon + CloudNativeCon Europe 2025 · on Friday, 2025-04-04· at 15:15· Level 1 | Hall Entrance S10 | Room C·
summary
Argues authorization belongs in the critical path and treated as a dev workflow with concrete patterns: policy as a service and sidecar deployments, plus multi-layer checks and request context enrichment. Compares tools—OPA (Rego), OpenFGA (Zanzibar-style relationships) and Serbos (YAML policies, playground/testing)—and cites a real regression story where a refactor exposed ~15 million private posts. Gives testing-first, policy-driven design and audit logging as practical steps that customers use to reduce bugs and speed feature delivery.
AI-written summary · about
chapters (14)
- 0:00Introduction to authorization
- 1:01The authorization paradox
- 2:28Evolution of development
- 3:32Challenges in authorization
- 5:14Workflow-first authorization
- 7:30Architectural shift
- 8:58Product feature perspective
- 10:39Core design principles
- 13:00Context-aware security
- 15:14Development lifecycle integration
- 18:00The authorization ecosystem
- 23:34Choosing the right tool
- 24:41Practical implementation patterns
- 30:25Summary and conclusion
related talks
29mAuthz as a dev workflow
42mBeyond Code: Shaping Security in a Developer-Driven World
45mThe Future of Authorization in Applications
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
43mApplication Code of Conduct - Full-Stack Policy as Code
27mLove, Hate, and Policy Languages
25mThe Root of Auth Thingz
42mExploring Best Practice for Implementing Authn and Authz in a Cloud-Native...