Why Authorization is Hard
summary
Authorization splits into modeling enforcement and architecture and the concrete choices decide whether to watch: practical claim — apps need to answer “can user do action on resource” with 22 authorization models already observed; tools actually used — push checks into queries or DB filters including row level security, encode small claims in JWT for small datums, or centralize into an auth service; numbers that matter — Google runs about 10 million queries per second with trillions of rows and multi‑nines uptime; building a central service works but takes years and full teams, and vendors like Oso aim to cut that effort.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:30What is Authorization
- 3:05Why Authorization is Important
- 4:03Modeling Authorization
- 10:42Enforcement
- 15:52In a nutshell
- 17:20Architecture
- 19:33Centralized Logic
- 21:48Decentralized Data
- 23:48Centralize Data
- 26:48Resources
related talks
45mThe Future of Authorization in Applications
58mImplementing authorization in web applications and APIs
09mThe difference between authentication and authorization
29mAuthz as a dev workflow
05mAre you talking about Auth with and N or a Z?
01h 02mImplementing authorization in web applications and APIs
59mProvably secure authorization
51mAuthorization beyond @RolesAllowed