liveBookmanning.com

What you will learn in Authorization in Action

Build policy-based access control for Zero Trust, APIs, SaaS, and AI agents

by Phil Windley
Foreword by Sarah Cecchetti

Read it on liveBook Get the book at manning.com

Chapter by chapter

Concepts explained in this book

• authorizationAuthorization is the process of determining and enforcing what an authenticated identity is permitted to access or do.
• policyAn authorization policy is a declarative rule or set of rules that determines which subjects may perform which actions on which resources under specified conditions.
• CedarCedar is a policy language designed specifically for expressing authorization policies and evaluating access-control logic.
• policy enforcement pointAn enforcement point is a system component or boundary at which an authorization decision is applied to allow or prevent an operation.
• relationship-based access controlA relationship permission is an access rule or authorization pattern in which permission depends on an authorization-relevant relationship between entities.
• attribute-based access controlAttribute-based access control (ABAC) is an authorization approach that makes decisions by evaluating attributes of subjects, resources, actions, and contextual conditions against rules.
• policy-based access controlPolicy-based authorization determines access from explicitly defined rules or policies evaluated against identities, resources, actions, and conditions.
• authenticationAn authentication mechanism is a method or procedure for verifying the identity of an entity attempting to log in.
• authorization requestAn authorization request is a structured query asking whether a principal may perform an action on a resource under specified conditions.
• governanceA governance framework is a structured system that assigns responsibility, establishes applicable standards, and coordinates work across teams or systems.
• attributeAn identity attribute is a piece of information describing an entity in a digital identity system.
• contextContext is the current information and attributes surrounding an access request that can affect an authorization decision.
• authorization decisionAn authorization decision is the determination of whether a principal is allowed to perform an action on a resource.
• dynamic adaptabilityDynamic authorization is an access-control technique that evaluates whether access is permitted at request time using current context and authorization information.
• delegationDelegation is an authorization in which one entity grants another authority to act on its behalf within a defined scope.
• PARC modelThe PARC model is an authorization framework that describes an access decision using a principal, action, resource, and conditions or context.
• edgeA relationship edge is a graph connection that records an association between entities or between an entity and a resource.
• layered policy architectureLayered authorization is an approach in which multiple domains or system components independently enforce their own policies.
• role-based access controlRole-based access control is an authorization model that assigns permissions to roles and grants principals those roles rather than assigning permissions directly to each principal.
• graphA relationship graph is a graph representation of entities and the relationships connecting them, including authorization-relevant relationships.
• decentralized credentialA verifiable credential is a digitally signed claim whose origin and integrity can be checked by a verifier.
• testA test is an executable check that evaluates software behavior against expected outcomes.
• issuerA credential issuer is an entity that creates or signs credentials and whose authority may be recognized for specified credential types.
• policy information pointA policy information point is an authorization component that supplies identity, attribute, relationship, or contextual information for policy evaluation.
• roleA role is an authorization abstraction that groups permissions or access responsibilities for assignment to principals.
• principalA principal is an entity, such as a person, machine, or process, that can initiate an action in an authorization system.
• policy as codePolicy as code is an approach that represents policy as machine-readable, version-controlled, and testable software artifacts.
• policy checkPolicy evaluation is the process of determining whether a request satisfies the rules and conditions in an authorization policy.
• zero-trust networkingA zero-trust environment is a security architecture that grants no implicit trust based solely on network location or system boundary.
• actionAn action is an operation that a principal attempts to perform on a resource.
• AI agentA software agent is a software system that acts autonomously or semi-autonomously on behalf of a person, organization, or another system.
• conditionA condition is a contextual requirement that determines whether an authorization request is permitted or denied.
• static analysisStatic analysis is the examination of programs or policies without executing them to identify properties, errors, or behavioral consequences.
• access control listAn access control list is a list of permissions associated with a resource that specifies which entities or groups may access it.
• policy languageA policy language is a formal language whose syntax and semantics allow authorization policies to be represented and processed by software.
• trustTrust is the willingness to rely on another person or entity despite vulnerability to that party's actions and possible failure.
• architecture decision recordAn architectural decision record is a version-controlled document that captures the context, rationale, decision, consequences, and related artifacts for an architectural choice.
• API gatewayAn API gateway is a service that receives, routes, and often governs requests to backend APIs.
• contextual signalA contextual or trust signal is an observed or supplied value about the circumstances of an identity or access request that is relevant to an authorization decision.
• authorization modelAn authorization model is a conceptual scheme for representing authority and determining how permissions are assigned or evaluated.
• schemaA schema is a formal description of the structure, types, and constraints of data stored or exchanged by a system, including Cedar entity types, attributes, actions, and context.
• authorization contextExternal context is authorization-relevant information about an entity or situation that originates outside the system making the access decision.
• verifiable credential presentationA verifiable presentation is a holder-generated object that packages selected claims from one or more verifiable credentials for presentation to a verifier, with proof of integrity and provenance.
• scopeA scope is the policy element that identifies the principals, actions, and resources to which a policy applies.
• identity platformA digital identity system manages digital identities and commonly provides authentication, identity attributes, and related services to other applications or systems.
• trust storeA trust store is a repository of trusted certificates, public keys, or identity records used to establish the trustworthiness of parties or credentials.
• static authorizationA static authorization system evaluates access using fixed authorization data rather than changing request context.
• sidecar processA sidecar is a separately deployed component or proxy that runs alongside a primary service to provide supporting functionality.
• policy lifecyclePolicy lifecycle management is the practice of governing policy ownership, review, verification, standardization, change, and retirement over time.
• groupA group is a named collection of principals or resources to which shared access rules can be applied.
• entityAn entity is a person, organization, service, thing, or AI agent that can participate in relationships with a digital identity system.
• foundational security policyA foundational policy is an enterprise-wide authorization policy that establishes baseline security requirements every access request must satisfy.
• API keyA shared secret is information known to communicating parties and used as evidence of their association or identity.
• RegoRego is a declarative policy language used to express rules evaluated by policy engines such as Open Policy Agent.
• OAuthOAuth 2.0 is an open authorization framework that lets applications obtain limited delegated access to protected resources without exposing a user's credentials.
• service meshA service mesh is an infrastructure layer that manages communication among microservices, including routing, load balancing, discovery, security, and observability.
• decision infrastructureDecision infrastructure is the collection of services and mechanisms that support the evaluation, explanation, and governance of authorization decisions.
• authorization code flowThe authorization code grant is an OAuth flow in which a client obtains a short-lived authorization code after user authorization and exchanges it for an access token.
• client credentials grant typeA client credentials grant is an OAuth grant type in which a client authenticates with its own credentials to obtain an access token without representing an end user.
• confused deputy problemThe confused deputy problem is a security failure in which an authorized intermediary is induced to use its own authority for another principal without correctly applying that principal's permissions.
• principle of least privilegeThe principle of least privilege requires each subject to receive only the access necessary to perform its authorized tasks.
• XACMLXACML is an OASIS standard for representing authorization policies and defining a model for evaluating access-control decisions.
• policy as dataPolicy as data represents authorization rules as structured information that an authorization engine evaluates at runtime.
• namespaceA namespace is a prefix or naming context that distinguishes entities, actions, policies, or types belonging to different domains or systems.
• freshnessSignal freshness is the degree to which authorization context reflects current conditions at the time of evaluation.
• policy storeA policy store is a repository that contains authorization policies for retrieval and evaluation.
• enrollmentEnrollment, or onboarding, is the process of establishing an entity's identity, accounts, access, and relationship with a digital system or organization.
• policy residualA policy residual is the partially evaluated predicate that expresses the remaining constraints under which an authorization policy would allow access.
• digital walletA digital wallet is software or a device-managed application that stores cryptographic or verifiable credentials and generates presentations of them.
• shared operational policyA shared operational policy is an authorization rule owned by a functional group and applied across multiple systems or workflows without being an enterprise-wide requirement or a single-application rule.
• policy setA policy set is a collection of authorization policies considered together when analyzing or evaluating access behavior.
• device posture signalDevice posture is a current, context-dependent assessment of a device's trustworthiness based on its management, security controls, health, environment, and recency of attestation.
• application-specific policyAn application policy is an authorization policy that defines permitted resources, actions, and authorities for a specific service or application domain.
• credential holderA credential holder is an entity that possesses a verifiable credential and can generate and present it to a verifier.
• cross-domain delegationCross-domain delegation is the transfer of authority between authorization domains controlled by different organizations.
• promiseA promise is a communicated commitment describing how an autonomous agent or system will behave under specified circumstances.
• reputationReputation is an assessment of an agent or organization based on the observed results of its past commitments and interactions.
• OpenFGAOpenFGA is an open-source authorization system for evaluating permissions through relationships among users and resources.
• decision layerA decision layer is an architectural layer that brings access-request inputs and authorization rules together to produce governed access outcomes.
• data integrityRelationship integrity is the preservation of confidence that an interaction continues to involve the same authorized entity in an identity relationship.
• policy administration pointA policy administration point is an authorization architecture component through which policies or policy-relevant relationships are created and modified.
• digital identityDigital identity is the set of information and relationships that represent an entity within an online system.
• revocationCredential revocation is the invalidation of a credential before its expiration date.
• authorization serverAn authorization server is an OAuth component that authenticates clients or users, obtains authorization, and issues authorization codes and tokens.
• society of agentsA society of agents is a cooperative environment in which independent software systems interact under shared rules, protocols, and governance mechanisms.
• schema validationSchema validation is the process of checking data or configuration against the structure, types, and constraints defined by a schema.
• consistencyConsistency is the uniform interpretation and application of authorization requests and decisions across enforcement components.
• Promise theoryPromise theory is a model of cooperation in which autonomous participants make behavioral promises that others may choose to rely on.
• request-time authorizationRequest-time authorization determines authority when a request is made using evidence carried with or associated with that request.
• verifierA verifier is an entity that checks the validity, provenance, and trustworthiness of presented claims or credentials.
• identityIdentity is the notion of what makes an entity recognizable as itself, understood in this section through attributes or an underlying entity representation.
• policy repositoryA policy repository is a managed source location containing authorization policies and their revisions before deployment to a policy store.
• authorityAn authority is an entity recognized as having the standing to issue claims or make authoritative determinations about a subject.
• decentralized identity systemSelf-sovereign identity is an identity model in which individuals control and manage the sharing of their identity information.
• resource ownerA resource owner is the person or entity that controls protected data or resources and can authorize an application to access them.
• authorization pressureAuthorization pressure is the increasing difficulty of making authorization decisions consistently, explaining outcomes, and maintaining control as access scenarios grow more complex.
• Cedar Analysis CLICedar Analysis is a static analysis tool for checking Cedar policies and their properties.
• continuous authorizationContinuous authorization is the repeated evaluation of access requests in context rather than granting durable access after a single authentication or authorization event.
• conversational aiAn AI system is software that applies artificial-intelligence capabilities to perform or assist with tasks such as interpreting information, generating content, analyzing artifacts, or making recommendations.
• authenticityAuthenticity is the property of being able to establish with confidence who the parties to a communication are and prove that identity to others.
• AWS Identity and Access ManagementAWS Identity and Access Management is a managed AWS service for controlling access to AWS resources through identities, policies, and conditions.
• normalization layerA normalization layer is an architectural component that collects, standardizes, validates, and assembles data from heterogeneous sources for downstream processing.
• confidenceConfidence is the level of assurance that a digital identity, interaction, or system representation is reliable and accurate.
• delegation dataDelegation as data is a delegation model that represents transferred authority as structured data evaluated during authorization.
• entity dataAn entity store is a repository of entity records and the attributes or relationships associated with them.
• decision surfaceA decision surface is the total set of situations in which an authorization system must evaluate access.
• typed partial evaluationTyped Partial Evaluation is a Cedar technique that evaluates an authorization policy when one or more request elements are unspecified and derives the conditions or values that would satisfy the policy.
• partial evaluationPartial evaluation is the process of simplifying a policy using inputs and conditions already known before runtime evaluation.
• Open Policy AgentOpen Policy Agent is an open-source policy engine that evaluates declarative policies to make authorization and other policy decisions.
• mutual TLSMutual TLS is a Transport Layer Security configuration in which both communicating parties authenticate each other with certificates.
• SPIFFESPIFFE is a standard for identifying software workloads and enabling them to prove their identities.
• SPIFFE IDA SPIFFE ID is a URI-form identifier that identifies a software workload within the SPIFFE identity framework.
• SVIDAn SVID is a SPIFFE Verifiable Identity Document that a workload presents as cryptographic proof of its SPIFFE identity.
• claimA claim is a statement about an entity, such as an identity attribute, conveyed by an identity or authorization system.
• entitlementAn entitlement is an authorization grant representing a subject's allowed access to a resource or action.
• dynamic authorization modelA dynamic authorization model evaluates access decisions from changing policies, identities, resources, or contextual conditions rather than fixed permissions alone.
• assuranceAssurance is the degree of confidence that an authentication process correctly represents the identity of the entity being authenticated.
• externalized authorizationExternalized authorization is an authorization approach in which access decision logic and supporting identity information are maintained outside the protected application.
• cachingA cache is a temporary data store that retains copies of information for faster retrieval or reduced dependence on an origin system.
• policy templateA Cedar template is a reusable authorization policy containing reserved principal and resource slots that can be linked to concrete entity values to create specific policies.
• passkeyA passkey is a passwordless authentication credential based on a cryptographic key pair and unlocked by the credential holder.
• confidentialityConfidentiality is the protection of information from unauthorized access during storage, transit, and processing.
• naming standardA naming convention is an agreed pattern for assigning identifiers so related entities or policy elements are named consistently.
• deployment pipelineA CI/CD pipeline is an automated workflow that builds, tests, and delivers software or configuration changes through continuous integration and continuous delivery.
• unique identifierAn identifier is a name that uniquely represents an entity or boundary within a specified namespace.
• constraint-aware planningConstraint-aware planning is an agent planning technique that incorporates authorization constraints into strategy selection before actions are executed.
• privacyPrivacy, or information privacy, is the ability of individuals to control or limit the collection, access, sharing, and use of information about them.
• scope matchingPolicy matching is the process of determining whether an authorization policy applies to a request's principal, action, and resource.
• policy metadataPolicy metadata is descriptive information about authorization policies that supports their selection, indexing, or management.
• resource-based access controlA resource-based policy is an authorization policy attached to a resource that specifies which principals may access it and under what conditions.
• authentication factorAn authentication factor is a category of evidence used to verify an entity's identity during authentication.
• credential presentation protocolA credential presentation protocol is a communication protocol for requesting, transmitting, and verifying presented credentials and their claims.
• Cedar compilerThe Cedar compiler is software that compiles Cedar policies while checking them against Cedar's schema rules.
• brittle policyA brittle policy is an authorization policy whose correctness depends on volatile details and therefore can fail when those details change.
• forbid policyForbid is a policy effect that denies a matching authorization request and can override a permit effect.
• formal verificationFormal verification is the use of mathematically defined models and proofs to establish that software satisfies specified properties.
• scenario testingScenario testing evaluates behavior through specified end-to-end or contextual usage scenarios, potentially involving multiple policies or relationships.
• Cedar-agentCedar Local Agent is a reference implementation that exposes the Cedar engine through a REST API and manages policies and entities in memory.
• versioningA version control system is a software system that records and manages successive versions of files and supports operations such as rollback and audit.
• technical confidenceTechnical confidence is assurance in an identity system or access decision based on technological evidence, verification, and controls.
• relying partyA service provider is a person or organization that supplies a service to a customer or other recipient.
• dynamic plannerDynamic planning is the runtime selection and sequencing of actions in response to a goal and changing information.
• subjectA subject is the entity referred to in an account, policy, or authorization decision, potentially referring to a principal or resource.
• authorization before retrievalAuthorization before retrieval is a design pattern that applies authorization constraints before protected content is fetched for an AI-mediated request.
• policy effectAn effect is the policy element that specifies the outcome produced when a policy applies, such as allowing or denying access.
• credential verificationCredential verification is the process of checking a credential's cryptographic validity, issuer, status, and applicable trust requirements.
• separation of concernsSeparation of concerns is a design principle that divides a system into parts with distinct responsibilities and limited overlap.
• TLSTransport Layer Security is a cryptographic protocol that provides secure communication over a network, including encryption and peer authentication.
• authorization layerAn authorization layer is a distinct system layer that evaluates or enforces authorization rules for requests crossing its boundary.
• federated identity integrationFederated identity is an identity model in which organizations trust one another to exchange authentication results and identity attributes so that one organization can provide identity services to another.
• OAuth scopeAn OAuth scope is a named bundle of API capabilities that limits the access delegated to a client and represented in an OAuth token.
• analyzabilityAnalyzability is the property of a language or policy set that permits tools to reason about its behavior and verify relevant properties.
• satisfiability modulo theoriesAn SMT solver determines whether logical formulas are satisfiable under combinations of mathematical theories such as equality, sets, strings, and numbers.
• symbolic reasoningSymbolic reasoning analyzes general formulas representing sets of possible inputs and behaviors instead of checking only concrete examples.
• challenge-response authenticationChallenge-response authentication is a technique or protocol that verifies identity by requiring a claimant to produce a valid response to a fresh system-provided challenge.
• policy serviceA policy service is a software service that centrally stores, evaluates, or manages authorization policies for multiple applications or systems.
• relationship tupleA relationship tuple is a structured record identifying a relationship between a subject and a typed object in a relationship-based authorization system.
• security levelA clearance level is an authorization classification indicating the sensitivity of information or operations a principal may access.
• MCP serverAn MCP server is a software component that exposes tools and data-source capabilities through the Model Context Protocol.
• MCPModel Context Protocol is a standard protocol for connecting AI applications to external tools and data sources.
• tool usageA tool invocation is a request by an agent or software system to execute an operation provided by an external tool.
• request-driven testA request-driven test evaluates authorization behavior by submitting constructed authorization requests and checking the resulting decisions.
• ZanzibarZanzibar is Google's globally scalable authorization system that evaluates access through a graph of relationships among users, resources, and other entities.
• identity lifecycleAn identity life cycle is the sequence of stages through which an identity account and its information are enrolled, updated, used, and deactivated.
• permit policyPermit is a policy effect that allows a matching authorization request.
• workload identityA workload identity is the identity of a service or process making a request on behalf of a principal.
• managed deviceA managed device is a device whose security state and configuration are administered and verifiable by an organization.
• complianceCompliance is adherence to applicable legal, regulatory, contractual, or organizational requirements.
• policy deploymentPolicy deployment is the process of delivering authorization policies from managed source repositories to systems that enforce them.
• policy ownerA policy owner is the person or organizational role responsible for a policy and its alignment with business intent.
• filteringA retrieval filter is a constraint applied to search or retrieval operations to limit returned resources to those satisfying specified conditions.
• proximity problemThe proximity problem is the difficulty of recognizing and interacting with entities that are physically distant in an online system.
• policy bundleA policy bundle is a packaged collection of reviewed authorization policies prepared for versioned deployment and runtime evaluation.
• trust frameworkA trust framework is a set of legal, policy, and technical agreements that defines how parties exchange identity information and what assurances they provide.
• attribute queryAn attribute query is a request identifying the claims or attributes needed from a holder for an access decision.
• authorization responseAn authorization response is the result of evaluating an authorization request, typically containing an allow or deny outcome and possibly additional metadata.
• determining policyA determining policy is a satisfied policy that directly influences the outcome of an authorization decision.
• satisfied policyA satisfied policy is a policy whose conditions match the context of an authorization request.
• policy managementPolicy management is the lifecycle practice of reviewing, versioning, deploying, and rolling back authorization policies.
• possession factorA possession factor is an authentication factor based on an object or device that the claimant is expected to possess.
• overrideA policy override is a rule or configuration that applies a local exception to an otherwise applicable authorization policy without modifying the base policy.
• Amazon Verified PermissionsAmazon Verified Permissions is an AWS managed service for defining and evaluating fine-grained authorization policies.
• CedarlingCedarling is an embeddable authorization component that provides Cedar policy evaluation, JWT claim mapping, and supporting policy-decision functions.
• hybrid deploymentA hybrid deployment combines locally running authorization evaluation with remotely managed policy or entity storage.
• is_authorized APIThe Cedar is_authorized API is an interface that evaluates a Cedar authorization request and returns an access decision.
• security perimeterPerimeter security is an approach that controls access primarily through network boundaries and location-based restrictions.
• retrieval-augmented generationRetrieval-augmented generation is a technique that supplies a generative model with externally retrieved information when producing an output.
• approverA policy approver is the person authorized to approve an authorization policy for progression through its governance process.
• content creatorA policy author is the person or principal responsible for creating a policy or policy change.
• reviewerA policy reviewer is a person responsible for examining an authorization policy for correctness, compliance, or approval.
• expiration dateAn expiration date is the recorded date after which a document or credential is no longer considered valid for its intended purpose.
• role hierarchyA role hierarchy is an authorization structure in which roles can inherit permissions from other roles to represent levels of responsibility.
• runtime evaluationRuntime evaluation is the assessment of a request and its applicable rules while an application or system is operating.
• separation of dutiesSeparation of duties is a control principle that assigns a sensitive process to multiple people so that no single person performs all conflicting responsibilities.
• policy scope prefilterA policy scope prefilter is a candidate-filtering technique that applies statically known policy constraints before complete authorization evaluation.
• type safetyStrong typing is a language property in which values and operations obey enforced type rules that prevent invalid combinations.
• language modelA large language model is a machine-learning model trained on extensive text data to process and generate language.
• accountabilityAccountability is the condition in which actions and decisions can be attributed to responsible parties and evaluated against applicable rules.
• role explosionRole explosion is the proliferation of narrowly scoped authorization roles created to accommodate exceptions, contextual conditions, or edge cases.
• signal delivery modelA signal delivery model specifies how contextual signals reach an authorization system, such as through tokens, queries, event streams, or local agents.
• three-dimensional choice spaceA three-dimensional choice space is a model that organizes authorization-context decisions by signal type, delivery method, and freshness requirement.
• microservice architectureMicroservices is an architectural pattern in which an application is composed of independently deployable services that communicate over a network.
• Unix file permissionsA Unix operating-system mechanism that assigns read, write, and execute rights to files and directories for owners, groups, and other users.
• credentialA credential is information or an artifact presented as evidence of an entity's identity, qualifications, status, or authorization.
• identity providerA central identity provider is a service that centrally manages digital identities and supplies authentication or identity information to relying applications or other systems.
• agent loopAn agent loop is an iterative execution pattern in which an AI agent plans actions, executes permitted actions, evaluates results, and revises its strategy.
• one-time codeA one-time password is a temporary authentication code intended to be accepted only once or during a limited validity period.
• decentralized identifierA DID-based identifier is an identifier derived from a decentralized identifier used to identify a credential subject or related party.
• issuance protocolAn issuance protocol is a communication protocol that defines how verifiable credentials are created and delivered to holders.
• OpenID4VCOpenID4VC is a family of OpenID specifications for issuing and presenting verifiable credentials using web identity infrastructure.
• W3C Verifiable Credentials Data ModelThe W3C Verifiable Credentials Data Model is a W3C specification defining a data model for digitally verifiable credentials and presentations.
• protocol-neutral verification layerA protocol-neutral verification layer is an authorization component that validates credential presentations independently of the protocols used to deliver them.
• policy enforcementRuntime enforcement is the application of authorization decisions to actions when they are executed with complete request information.
• policy infrastructureShared policy infrastructure is an architectural arrangement in which authorization policies and supporting decision mechanisms are provided consistently across multiple services.
• role assignmentA role assignment is a configuration that associates a principal with an authorization role.
• riskRisk is the possibility of an unfavorable outcome or failure arising from dependence on uncertain actions or conditions.
• namespace managementNamespace design is the specification of how names are structured, assigned, scoped, and resolved within an identity system.
• tenant isolationTenant isolation is the separation of each customer's data, resources, and operations from those of other customers in a shared system.
• OpenID4VCIOpenID4VCI is an OpenID standard for issuing verifiable credentials to credential holders.
• provenanceProvenance is the traceable origin and history of data or a signal, including information that identifies its issuer and issuance context.
• control planeA control plane is the set of interfaces and mechanisms used to define, configure, govern, and manage a system's behavior and infrastructure.
• identity governance and administrationIdentity Governance and Administration is the discipline and set of capabilities for governing identity life cycles, entitlements, access requests, approvals, and access certifications.
• certificateA digital certificate is a signed data record that binds an identity or domain name to a public key.
• artificial intelligenceArtificial intelligence is the field of computing concerned with systems that perform tasks requiring capabilities associated with human intelligence, such as pattern analysis and language processing.
• password authenticationA password is a secret sequence of characters used to authenticate a person or account.
• deny-overridesDeny-overrides is a policy-combining rule in which any applicable deny result takes precedence over permit results.
• policy analysisPolicy analysis is the systematic examination of authorization policies to determine whether they satisfy specified logical or security properties.
• log analysisAutomated log analysis is the computational examination of recorded system events to detect anomalies, rule problems, and unexpected behavior.
• wallet standardA wallet standard specifies how digital credentials are stored, protected, and managed on a holder's device.
• centralized namespaceA centralized namespace is a naming system maintained by one organization that ensures identifier uniqueness.
• federated namespaceA federated namespace is a distributed naming system in which multiple organizations or services share responsibility for assigning names.
• flat namespaceA flat namespace is a naming system without hierarchical structure in which identifiers are intended to avoid collisions across contexts.
• hierarchical namespaceA hierarchical namespace is a naming system whose identifiers are organized into levels beneath a root or other parent nodes.
• openid connectOpenID Connect is an identity layer built on OAuth 2.0 that enables clients to verify user identity and obtain basic profile information from an authorization server.
• delegation rightA delegatable right is an authorization that permits its holder to grant access or delegate authority to another principal.
• explainable outputAn explanation is an account of the reasons why an authorization request received a particular outcome.
• credential verification serviceA verification service is a software service that checks the validity, integrity, and trust conditions of presented credentials.
• source of truthA source of truth is the authoritative system or record from which the correct value of information is obtained.
• Security Assertion Markup LanguageSAML is an XML-based standard for exchanging authentication, authorization, and identity information between security domains.
• policy layerA policy layer is a logically distinct scope of authorization policies governed and managed as a unit.

These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.