Authorization
Enforcing client access permissions across system boundaries (OAuth2, scopes, claims).
What you'll learn
- Role-Based Access Control (RBAC)
- Attribute-Based Access Control (ABAC)
- Relationship-Based Access Control (ReBAC)
- JWT Claims-Based Authorization
- Policy Enforcement Point (PEP) vs Decision Point (PDP)
- Principle of Least Privilege
TL;DR
Enforcing client access permissions across system boundaries (OAuth2, scopes, claims).
Visual System Topology
Authorization Network Handshake Flow
Concept Overview
Authorization determines what an authenticated user is allowed to do — answering "what can you access?" after identity has been established. It enforces access control policies across resources, APIs, and data.
Modern authorization has evolved from simple role checks ("is the user an admin?") to fine-grained attribute-based policies ("can this user in this department access this document in this classification at this time of day?"). The three dominant models are RBAC (Role-Based Access Control), ABAC (Attribute-Based Access Control), and ReBAC (Relationship-Based Access Control — used by Google Zanzibar/Google Drive).
Authorization decisions must be fast (< 5ms), consistently enforced at every API boundary, and auditable (every decision must be logged). The most dangerous authorization flaw is the "confused deputy" problem: a privileged service is tricked into performing actions on behalf of a less-privileged user.
Key Architectural Pillars
Role-Based Access Control (RBAC)
Permissions are assigned to roles; users are assigned to roles. Simpler to manage than per-user permissions. Standard roles: admin, editor, viewer. Works well for small user populations with clear role boundaries.
Attribute-Based Access Control (ABAC)
Access decisions based on attributes of the user, resource, action, and environment. More expressive than RBAC but more complex. AWS IAM policies are ABAC: "allow users with tag Department=Engineering to write to S3 buckets with tag Environment=Dev."
Relationship-Based Access Control (ReBAC)
Access is determined by the relationship graph between users and resources. Used by Google Zanzibar (powers Google Drive, Docs, Calendar). Can express: "user A has access to document D if A is a member of a group that has viewer permission on D."
JWT Claims-Based Authorization
Embed authorization metadata directly in the JWT payload: user roles, feature flags, tenant ID, subscription tier. Services validate the JWT and read claims without calling an external authorization service. Fast but stale (claims only update on token refresh).
Policy Enforcement Point (PEP) vs Decision Point (PDP)
PEP: where authorization is enforced (API Gateway, middleware, service). PDP: where authorization decisions are made (OPA, Casbin, AWS IAM). Separating PEP from PDP centralizes policy management and enables policy-as-code.
Principle of Least Privilege
Every user, service, and process should have only the minimum permissions necessary to perform its function. Limits blast radius of compromised accounts or buggy code.