The never-ending product requirements of user authorization
How a simple authorization model based on roles is not enough and gets complicated fast due to product packaging, data locality, enterprise organizations and compliance.
- from
- IAM
- added
- 2026-10-10
- likes
- 0
similar
-
AWS IAM Roles, a tale of unnecessary complexity infosec.rodeo
The history of fast-growing AWS explains how the current scheme came to be, and how it compares to GCP's resource hierarchy.
-
Why Authorization is Hard osohq.com
Because it needs multiple tradeoffs on Enforcement which is required in so many places, on Decision architecture to split business logic from authorization logic, and on Modeling to balance power and complexity.
-
IAM Is The Real Cloud Lock-In forrestbrazeal.com
A little click-baity, but author admit that “It depends on how much you trust them to 1. Stay in business; 2. Not jack up your prices; 3. Not deprecate services out from under you; 4. Provide more value to you in business acceleration than they take away in flexibility.”
-
RBAC like it was meant to be tailscale.com
How we got from DAC (unix permissions, secret URL), to MAC (DRM, MFA, 2FA, SELinux), to RBAC. Details how the latter allows for better modeling of policies, ACLs, users and groups.
-
Descope descope.com
Drag and drop your auth. Add authentication, user management, and authorization to your app with a few lines of code.
-
Authorization Academy osohq.com
An in-depth, vendor-agnostic treatment of authorization that emphasizes mental models. This guide shows the reader how to think about their authorization needs in order to make good decisions about their authorization architecture and model.
IAM › Authorization > Policy models: “How a simple authorization model based on roles is not enough and gets complicated fast due to product packaging, data locality, enterprise organizations and compliance.”