Permissions: Centralized or Decentralized? Both!
summary
Argues organizations should use three concrete policy layers — central policy store, application local policies, and distributed cached policies — and shows examples written in Cedar policy language. Calls out hard numbers: about 80% of workload identities go unused and roughly 5% of workload permissions are necessary, so prioritize visibility, audit logs, and governance. Recommends MFA, short‑lived just‑in‑time credentials, break‑glass with logged reconciliation, and pushing decisions to the edge only when latency, connectivity, and reconciliation guarantees are met.
AI-written summary · about
chapters (20)
- 0:00Authorization challenges and risks
- 4:21User stories with Jetsons analogy
- 7:36Introduction
- 10:55Seven steps to better authorization
- 11:38Visibility into user groups and workloads
- 14:51Workload identity challenges
- 17:48Policy ownership and org structure
- 18:32Brownfield vs greenfield authorization
- 21:01Authorization strategies: central, local, distributed
- 22:26Centralized policies: control and security
- 25:14Decentralized policies: low latency and offline
- 26:40Distributed and cached policies for scalability
- 27:47Audit logs as feedback loops
- 29:56Authorization in disconnected manufacturing
- 31:02Governance and access reviews at scale
- 33:07Policy reviews and break glass procedures
- 36:18Monitoring abnormal deny patterns
- 37:45Handling brownfield authorization systems
- 39:11Next steps: centralizing permissions
- 41:41Q&A
related talks
31mAccess Policies for Hybrid Cloud Environments
54mAuthorization for modern Applications
41mBuilding Modern Authorization: A Practical Guide To Centralized, Distributed, and...
36mCentralized Policy Management
45mThe Future of Authorization in Applications
49mLove, Hate, And Policy Languages
27mLove, Hate, and Policy Languages
43mApplication Code of Conduct - Full-Stack Policy as Code