AuthZEN in Practice: Standardizing Authorization for Cloud Native Platforms and Agents
summary
AuthZEN Authorization API 1.0 is a standard PEP–PDP interface finalized January 2026 and implemented experimentally in Keycloak (v26.7 demo). The demo runs on Minikube with Keycloak as OAuth server and PDP, Nginx as PEP/resource server, and MCP Inspector as client; requests map MCP tool calls into AuthZEN requests and Keycloak returns allow/deny decisions. Example policies: finance group allows Alice but not Bob, and a parameter policy requiring customer_id ≥ 1000 enforces per-request denial; ARP and COZY drafts add approval flows and discoverable mappings.
AI-written summary · about
chapters (10)
- 0:00AuthZEN introduction
- 1:52Why authorization matters
- 3:38AuthZ standardization
- 5:27AuthZ reference architecture
- 7:38AuthZ API categories
- 10:30AuthZ in cloud native
- 11:36Demo with Keycloak
- 14:43Keycloak step-by-step
- 27:27Key takeaways
- 28:11Q&A on PEP
related talks
55mAuthEN: Standards for modern authorization
24mExpanding beyond authentication with emerging authorization standards
29mAuthz as a dev workflow
15mFrom OpenID Connect to OpenID AuthZEN
16mAccess Granted with AuthZed
42mExploring Best Practice for Implementing Authn and Authz in a Cloud-Native...
51mAuthorization beyond @RolesAllowed
06mStandardizing Authentication Flows in Keycloak Environments – Efficient Authorization S...