about this book
Authorization is a fundamental feature of nearly every computer system and every digital relationship. Knowing who someone is has never been enough. We also need to know what they can do, under what conditions, on whose behalf, and in which context. Yet for years, Identity and Access Management has focused far more on authentication than on access control. Authorization logic has been embedded in application code, scattered across databases, and managed through brittle role hierarchies that break down under the weight of cloud computing, microservices, multi-tenancy, and AI.
Authorization in Action argues that this approach no longer works. Dynamic authorization, built on externalized policies treated as code or data, gives organizations a practical way to make consistent access decisions across applications, APIs, data, devices, and AI systems. This book provides the conceptual frameworks, architectural patterns, and hands-on skills needed to understand and apply policy-based access control in real-world systems.
- Authentication is not enough.
- Authorization logic has outgrown the application.
- Policy-based access control is the right abstraction for modern authorization.
- Treating policy as code makes authorization operationally manageable.
- Dynamic authorization is foundational to zero trust, compliance, delegation, multi-tenancy, and AI governance.
- Authorization is infrastructure for digital trust.