Authorization
Authorization is the determination and enforcement of rules governing which subjects may access resources or perform operations.
Authorization in Action
Authorization is the process of determining and enforcing what an authenticated identity is permitted to access or do.
- How it is used
- Frames how identity relationships become enforceable decisions about actions, resources, and conditions.
- How deep it goes
- Defines access control and authorization, explains contextual inputs and architecture, but defers detailed policy-model implementation.
- Examples
- Uses Target and Ring breaches plus managers, shift-bound agents, registered devices, and contractors.
- What you can do after
- Evaluate/understand why authenticated identities still require contextual, enforceable limits on their actions.
Spring Security in Action, Second Edition
Authorization is the process of determining whether an authenticated entity has permission to perform an action or access a resource.
- How it is used
- Separates identity verification from permission decisions across endpoints, methods, and reactive application layers.
- How deep it goes
- Traces authorization from the post-authentication filter through authorities, endpoint matchers, expressions, and method-security annotations.
- Examples
- Uses READ and WRITE users, HTTP Basic requests, endpoint restrictions, 403 responses, and a method protected by @PreAuthorize.
- What you can do after
- Apply it via Spring Security by configuring SecurityFilterChain rules and protecting methods with expression-based authorization.
Read how Spring Security in Action, Second Edition explains authorization →
ASP.NET Core in Action, 3e
Authorization is the process of determining whether an authenticated subject has permission to perform an operation or access a resource.
- How it is used
- Controls access to ASP.NET Core endpoints and individual resources according to the current user’s permissions.
- How deep it goes
- Works from basic [Authorize] checks through named policies, custom handlers, and checks performed after loading a resource.
- Examples
- Uses airport boarding checks, recipe ownership, and a minimal API deletion endpoint to make permission decisions concrete.
- What you can do after
- Apply it via ASP.NET Core attributes, policies, and IAuthorizationService to protect endpoints and user-owned resources.
Read how ASP.NET Core in Action, 3e explains authorization →
Secure APIs
An access authorization control determines which authenticated subjects are permitted to perform particular actions on protected resources.
- How it is used
- Protects API endpoints, resources, operations, and fields from authenticated identities lacking the required permissions.
- How deep it goes
- Explains authentication, authorization, BOLA, BFLA, BOPLA, roles, attributes, implementation, and automated tests.
- Examples
- Uses blog posts, payments, healthcare appointments, registrations, admin endpoints, internal APIs, and cross-user automated tests.
- What you can do after
- Diagnose/debug with two-user, role, attribute, and token tests that detect unauthorized resource or operation access.
Architecting an Apache Iceberg Lakehouse
Access control is the restriction of data or system operations to authorized users or services according to defined permissions.
- How it is used
- Uses access control to govern shared Iceberg data across storage, catalogs, query engines, teams, and consumption tools.
- How deep it goes
- Explains layered enforcement, RBAC, ABAC, credential vending, and auditability, but notes that row- and column-level standards remain unsettled.
- Examples
- Demonstrates healthcare records, business-unit isolation, public-cloud auditing, Azure ACLs, Dremio field-level controls, and brand-specific analytics policies.
- What you can do after
- Operate/configure layered permissions by aligning storage policies, catalog authorization, identity providers, query-engine enforcement, credentials, and audit logs.
Read how Architecting an Apache Iceberg Lakehouse explains authorization →
Generative AI in Action
Access control is the practice of restricting access to systems, resources, or data according to identity, policy, or authorization.
- How it is used
- Restricts access to enterprise documents, production resources, and model assets in generative AI applications.
- How deep it goes
- Identifies control types and deployment practices, but does not provide policy syntax or an end-to-end authorization implementation.
- Examples
- Uses Azure AI Search filters with permitted groups and LDAP memberships, plus model-repository compromise and insider leaks.
- What you can do after
- Operate/configure it by restricting document and production-resource access, then pairing those controls with monitoring and audits.
.NET in Action, Second Edition
Authorization is the process of determining which actions or resources an authenticated or anonymous principal is permitted to access.
- How it is used
- Restricts which authenticated API users may read or modify catalog data.
- How deep it goes
- Works through action attributes, named policies, and a claim-checking handler; does not develop broader Identity account management.
- Examples
- Uses catalog GET, POST, PATCH, and DELETE actions plus a preferred_username claim check.
- What you can do after
- Apply it via ASP.NET Core policies and an authorization handler to separate catalog readers from a designated editor.
Read how .NET in Action, Second Edition explains authorization →
Django in Action
Authorization is the process of determining which actions or resources an authenticated user is permitted to access.
- How it is used
- Protects multiuser Django views by deciding which authenticated users may perform or view an action.
- How deep it goes
- Demonstrates decorator-based login restriction and relationship checks inside a view, while deferring custom middleware.
- Examples
- Uses protected generic pages and musician profiles accessible only to owners or bandmates.
- What you can do after
- Apply it via Django’s @login_required decorator and custom view logic for ownership or membership rules.
Build AI-Enhanced Web Apps
Authorization is the process of determining which authenticated users or principals are permitted to access resources or perform actions.
- How it is used
- Controls access to AI features, message allowances, chat histories, and user data in vector stores.
- How deep it goes
- Defines authorization and shows route-level protection and a quota policy, while describing rather than implementing fine-grained vector-store controls.
- Examples
- Uses a Clerk-protected `/chat` route, a 10-message daily Upstash Redis limit, and shared vector-store filtering by user identifiers.
- What you can do after
- Apply it via Clerk route protection and Upstash Redis quotas, then specify access checks for chat histories and vector operations.
Read how Build AI-Enhanced Web Apps explains authorization →
Apache Kafka in Action
Access control is the enforcement of rules that determine which principals may access particular data or perform particular operations.
- How it is used
- Restricts authenticated Kafka clients to permitted actions on resources such as topics and consumer groups.
- How deep it goes
- Explains ACL fields and rule-check order with service permissions, but does not supply configuration commands.
- Examples
- Uses checkout, payment-processing, and analytics services to distinguish topic, consumer-group, and prefixed-topic permissions.
- What you can do after
- Operate/configure Kafka ACLs around each service’s required actions and monitor unauthorized-access signals.
Grokking Relational Database Design
The restriction of data or system operations according to the permissions granted to users or processes.
- How it is used
- Protects database confidentiality by limiting who can view, modify, or delete data.
- How deep it goes
- Defines MAC and RBAC, then works through role creation, grants, user assignment, and default-role activation.
- Examples
- Uses a high school records database and a retail database with product, purchase, review, and related tables.
- What you can do after
- Apply RBAC through SQL by creating roles, granting table permissions, creating users, and assigning roles.
Read how Grokking Relational Database Design explains authorization →
Amazon Web Services in Action, Third Edition: An in-depth guide to AWS
Authorization is the process of determining whether an authenticated identity may perform a requested action on a resource.
- How it is used
- Restricts which authenticated IAM identity may perform AWS API actions, including changes to managed resources.
- How deep it goes
- Defines authorization against authentication and demonstrates IAM group permissions and overriding Deny policies, but defers access inside databases to their engines.
- Examples
- Shows shared permissions through an IAM group and an RDS policy that allows management while denying destructive actions.
- What you can do after
- Apply it via AWS IAM identity policies to restrict service-management actions while recognizing that data access needs separate controls.
ScyllaDB in Action
Authorization is the process of determining whether an authenticated identity has permission to perform a requested operation.
- How it is used
- Limits ScyllaDB actions to designated users and application roles after authentication.
- How deep it goes
- Explains authorizer migration, configuration, role creation, grants, inheritance, and permission inspection; defers application connection details.
- Examples
- Uses a reviews API role granted SELECT and MODIFY on the reviews keyspace, plus Docker and cqlsh commands.
- What you can do after
- Operate/configure it by enabling enforced authorization and assigning inherited, keyspace-scoped permissions to application logins.
API Design Patterns
Authorization is the determination of whether an authenticated user is permitted to perform a requested operation.
- How it is used
- Applies authorization during collection listing so each requester sees only permitted resources.
- How deep it goes
- Explains requester-dependent filtering and contrasts it with 403 responses, without detailing broader access-control mechanics.
- Examples
- Uses ChatRoom and nested Message collections to illustrate different requester-visible results.
- What you can do after
- Apply it by returning only authorized resources when listing a collection containing mixed-access items.
Data-Driven Cybersecurity
Authorization is the process of determining and granting permitted access to resources or operations after an identity or entity has been established.
- How it is used
- Controls who may reach organizational resources and supports decisions about protecting sensitive data.
- How deep it goes
- Defines four access-control models and explains permission maintenance, but does not provide implementation instructions.
- Examples
- Illustrates failed access control through a patient-data incident with violation counts, response-time targets, and remediation.
- What you can do after
- Operate/configure it through role-aligned permissions, regular audits, and corrective action after access violations.
Spring AI in Action
Authorization is the determination of whether an authenticated subject has permission to perform a requested operation or access a resource.
- How it is used
- Protects generative AI retrieval and tool invocations from users lacking authority to access particular documents or answers.
- How deep it goes
- Implements metadata filtering, HTTP Basic authentication, in-memory users, and method-level role checks while deferring broader expression details.
- Examples
- Uses premium game-rule metadata, secured game-complexity tools, and authenticated HTTP requests from premium and nonpremium users.
- What you can do after
- Apply it via Spring Security to authenticate users, assign roles, filter premium content, and block unauthorized tool execution.
Kafka for Architects
Access control is the enforcement of rules governing which subjects can access particular resources or data attributes.
- How it is used
- Controls which Kafka participants may access resources as part of an enterprise security design.
- How deep it goes
- Defines ACL fields and common permission pitfalls, while leaving detailed setup instructions to external documentation.
- Examples
- Uses producer and consumer topic permissions and a prefix-matched producer ACL.
- What you can do after
- Apply common producer and consumer permissions with kafka-acls while accounting for additional access needs.
Grokking Web Application Security
Access control is the enforcement of rules governing which principals may access particular resources or perform particular actions.
- How it is used
- Frames access control as a defense against exploitable authorization flaws in web applications.
- How deep it goes
- Defines authentication, authorization, RBAC, and ABAC, then details enforcement placement, trusted inputs, denial responses, and tests.
- Examples
- Uses resource-ownership scenarios and an illegal post-edit unit test.
- What you can do after
- Apply it via RBAC and ABAC rules, server-side checks, explicit denial responses, and unit tests.
Read how Grokking Web Application Security explains authorization →
Building Distributed Applications that Work
Authorization is the process of determining which actions or resources an authenticated principal is permitted to access.
- How it is used
- Restricts online-shop purchases while leaving catalog browsing open.
- How deep it goes
- Defines permission checks and shows UI registration, middleware, and a page attribute; leaves protocol details at a high level.
- Examples
- Uses an open product catalog, restricted ordering, an admin-only page, and ASP.NET Core authorization calls.
- What you can do after
- Operate/configure it by registering ASP.NET Core authorization, adding its middleware, and protecting a UI page with [Authorize].
Read how Building Distributed Applications that Work explains authorization →
Spring in Action, Sixth Edition
Authorization is the process of determining which actions or resources an authenticated entity is permitted to access.
- How it is used
- Controls which web requests authenticated users may access by matching paths to security requirements.
- How deep it goes
- Defines path rules, role checks, rule precedence, and richer SpEL conditions with configuration examples.
- Examples
- Uses /design and /orders role checks, public routes, and a role-plus-weekday condition.
- What you can do after
- Configure URL access rules with role checks, permit-all behavior, or SpEL conditions.
Read how Spring in Action, Sixth Edition explains authorization →
Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu
Authorization is the process of determining which operations an authenticated identity is permitted to perform.
- How it is used
- Controls which CI/CD identities can assume cloud roles and who can access Terraform state.
- How deep it goes
- Explains the authentication–authorization distinction and AWS role restrictions, while leaving vendor-specific configuration details to each platform.
- Examples
- Uses a GitHub Actions workflow assuming an AWS role, an Azure service-principal mapping, and restricted production-state access.
- What you can do after
- Operate/configure it by restricting cloud-role assumption to intended workflows and limiting state access to necessary users and systems.
AI for Everyday IT
Access control is the restriction and management of who or what may access systems, data, or resources and which actions they may perform.
- How it is used
- Protects AI-powered functions and sensitive document workflows by limiting permitted resources, actions, tools, and users.
- How deep it goes
- Explains implementation through least privilege, human review, auditing, and adversarial testing, without detailing authorization protocols.
- Examples
- Uses read-only databases, restricted directories, approved anonymization tools, support logs, and adversarial prompts as concrete cases.
- What you can do after
- Operate/configure AI functions with restricted permissions, human review, access logging, and tests for forbidden-data requests.
MongoDB 8.0 in Action, Third Edition
Access control is the enforcement of rules governing which identities may access resources or perform operations.
- How it is used
- Controls which actions authenticated users and services may perform on Atlas resources and MongoDB deployments.
- How deep it goes
- Explains RBAC roles, privilege inheritance, built-in roles, and custom-role scoping, but does not detail every built-in permission.
- Examples
- Uses built-in database roles, a multi-role access example, and Atlas CLI commands for custom privileges.
- What you can do after
- Configure access by assigning roles or creating custom privileges scoped to the required resources.
Read how MongoDB 8.0 in Action, Third Edition explains authorization →
Bootstrapping Microservices, Second Edition: With Docker, Kubernetes, GitHub Actions, and Terraform
Authorization is the process of determining which actions or resources an authenticated participant is permitted to access.
- How it is used
- Protects application and data access from malicious use, including in microservices applications.
- How deep it goes
- Names authorization as a security technique but does not specify policies, implementation, or enforcement.
- What you can do after
- Understand authorization's role in protecting access within application security.
Acing the Certified Kubernetes Administrator Exam, Second Edition
Authorization is the process of determining which actions an authenticated subject may perform on protected resources.
- How it is used
- Controls which authenticated subjects may access Kubernetes API resources.
- How deep it goes
- Links authentication to RBAC permissions and identifies roles and bindings as access controls.
- Examples
- Demonstrates listing kube-system pods and limiting a user to viewing pods.
- What you can do after
- Configure permissions for users, groups, and Service Accounts using roles and bindings.
Read how Acing the Certified Kubernetes Administrator Exam, Second Edition explains authorization →
WordPress Power Toolkit: Harness AI to build next-level websites
A permission is an authorization specifying an action that a person may or may not perform on a website or with protected content.
- How it is used
- Controls collaborator access, protected content, embedded media, and automated visits to a website.
- How deep it goes
- Explains role capabilities and setup actions, then flags media consent and robots.txt risks without detailing implementation syntax.
- Examples
- Uses WordPress user roles, the Add New User screen, media release forms, YouTube embedding, and robots.txt.
- What you can do after
- Operate/configure website roles, request media permissions, and restrict automated access with appropriate caution.
Read how WordPress Power Toolkit: Harness AI to build next-level websites explains authorization →
Digital Twins in Action
Access control is the restriction and authorization of access to resources or actions according to identities, roles, or policies.
- How it is used
- Controls who or what may read data, change models, call services, or trigger physical actions in a digital twin.
- How deep it goes
- Works through an IAM policy and a Cedar evaluation, but defers a full treatment of digital twin governance and security.
- Examples
- Uses a read-only DynamoDB policy, a Cedar state-update request, and separately scoped maintenance-agent and dashboard identities.
- What you can do after
- Apply it via IAM roles and Cedar policies to restrict cloud-resource and application actions.
Kubernetes in Action, Second Edition
A file permission is an access right specifying whether a user class may read, write, or execute a filesystem object.
- How it is used
- Restricts access to files mounted from Secret and ConfigMap volumes by setting read, write, and execute rights.
- How deep it goes
- Defines permission categories and default modes, then covers configuration, decimal and octal notation, symbolic links, and group ownership.
- Examples
- Uses default mode 0644, configured mode 0740, and a Secret key mode of 0640.
- What you can do after
- Configure mounted-file permissions with defaultMode and inspect target-file permissions with ls -lL.
Read how Kubernetes in Action, Second Edition explains authorization →
Related concepts
- authenticationcontrasts with · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
- role-based access controlincludes · Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.
- principle of least privilegeconfigured by · The principle of least privilege is a security principle that grants each user, process, or other subject only the access rights necessary for its authorized tasks.
- securityused by · The protection of systems, information, resources, and operations against unauthorized access, use, disclosure, alteration, disruption, or destruction.
- rolepart of · A role is a defined function, responsibility, perspective, or set of permissions associated with a participant in an organization or system.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.