Why Authorization is Hard
Because it needs multiple tradeoffs on Enforcement which is required in so many places, on Decision architecture to split business logic from authorization logic, and on Modeling to balance power and complexity.
- from
- IAM
- added
- 2026-10-10
- likes
- 0
similar
-
The never-ending product requirements of user authorization alexolivier.me
How a simple authorization model based on roles is not enough and gets complicated fast due to product packaging, data locality, enterprise organizations and compliance.
-
Authorization Academy osohq.com
An in-depth, vendor-agnostic treatment of authorization that emphasizes mental models. This guide shows the reader how to think about their authorization needs in order to make good decisions about their authorization architecture and model.
-
IAM is hard. It's really hard. web.archive.org
“Overly permissive AWS IAM policies that allowed s3:GetObject to * (all) resources”, led to $80 million fine for Capital One. The only reason why you can't overlook IAM as a business owner.
-
In Search For a Perfect Access Control System web.archive.org
The historical origins of authorization schemes. Hints at the future of sharing, trust and delegation between different teams and organizations.
-
The Case for Granular Permissions cerbos.dev
Discuss the limitations of RBAC and how ABAC (Attribute-Based Access Control) addresses them.
-
Open Policy Agent github.com
🆓 An open-source general-purpose decision engine to create and enforce ABAC policies.
IAM › Authorization > Policy models: “Because it needs multiple tradeoffs on Enforcement which is required in so many places, on Decision architecture to split business logic from authorization logic, and on Modeling to balance power and complexity.”