Graph-Based Authorization: How to Secure Your API With Your Own Graph
summary
Broken access control remains the top OWASP issue, so the concrete fix shown is to externalize authorization into a PDP talking over Oden to a PEP (API gateway/proxy) and evaluate policies against an Identity Knowledge Graph. The graph models use ReBAC and NIST ENGAC-style ABAC patterns (example: tellers can access accounts only 09:00–17:00 implemented via obligations that create/ remove deny relationships). Recommended stack: Neo4j AuraDB + Knowledge Graph Builder for storage and policy evaluation; externalization makes policies provable and auditable.
AI-written summary · about
chapters (17)
- 0:00Introduction and speaker intro
- 0:51Basics of access control
- 3:00Authentication fundamentals
- 4:25Authorization essentials
- 5:49Zero trust and identity risks
- 7:14Zero trust core concept
- 7:57Subjects and resources defined
- 9:21Coarse vs fine grain access
- 11:12Role-based access control
- 14:03Relationship-based access control
- 16:32Attribute-based access control
- 19:22Building an identity graph
- 21:08Externalizing authorization
- 23:55Authorization system architecture
- 25:19Oden standard for APIs
- 27:02Key takeaways and conclusion
- 27:44Q&A session
related talks
24mExpanding beyond authentication with emerging authorization standards
21mGraphQL Authorization with Open Policy Agent
25mThe Root of Auth Thingz
45mThe Future of Authorization in Applications
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
25mThe right feature at the right place: the example of authorization
29mAuthz as a dev workflow
25mMake Your Security Policy Auditable