Authentication and authorization
Authentication and authorization are security processes that verify an entity’s identity and determine which actions or resources that entity may access.
Effective Platform Engineering
Authorization is the determination of whether an authenticated caller is permitted to perform a requested action or access a resource.
- How it is used
- Uses team-based authorization to give developers self-service access across platform tools and infrastructure.
- How deep it goes
- Works through membership sources and integration patterns, but defers detailed identity-provider options and implementation examples.
- Examples
- Uses GitHub teams, CircleCI context permissions, identity-provider integration, and a teams API that maintains RoleBindings and emits sync events.
- What you can do after
- Operate/configure team-based access so membership changes propagate across supported platform resources without separate developer requests.
Read how Effective Platform Engineering explains authentication and authorization →
Acing the CCNA Exam: Volume 2 Advanced Networking and Security
Authorization is the process of determining and granting the actions or resources an authenticated subject is permitted to access.
- How it is used
- Controls network and API access by verifying identities, granting permissions, and recording activity.
- How deep it goes
- Explains AAA roles, protocol differences, ports, encryption, and token flow without providing device configuration commands.
- Examples
- Uses Cisco IOS command permissions, network-access protocols, centralized AAA servers, and bearer tokens for protected API resources.
- What you can do after
- Evaluate access-control designs by distinguishing identity verification, permission granting, activity logging, and protocol trade-offs.
Kubernetes for Developers
Authorization is the process of determining which actions an authenticated identity may perform on system resources.
- How it is used
- Separates cluster identity verification from fine-grained Kubernetes permissions for deployers and other users.
- How deep it goes
- Explains credentials, IAM, RBAC bindings, namespaces, verbs, and denial outcomes, stopping short of broader policy design.
- Examples
- Uses Role, RoleBinding, ClusterRole, ClusterRoleBinding, kubectl commands, and Forbidden responses for a developer identity.
- What you can do after
- Operate/configure Kubernetes access by assigning IAM authentication and narrowly scoped RBAC permissions.
Read how Kubernetes for Developers explains authentication and authorization →
React in Depth
Authorization is the process of determining which authenticated users may access particular application resources or perform particular actions.
- How it is used
- Frames authentication and authorization as architecture concerns for securing user-specific application data.
- How deep it goes
- Connects login, signup, logout, utilities, and client UI, but defers backend-dependent password recovery.
- Examples
- Uses a multitenant goal-tracking site with sign-up, login, logout, and user-specific data.
- What you can do after
- Apply it by designing an entry flow with sign-up, login, logout, and user-specific data boundaries.
Read how React in Depth explains authentication and authorization →
Generative AI in Action
Authorization is the process of determining which resources or operations an authenticated entity may access.
- How it is used
- Secures data interactions in enterprise generative AI architectures handling sensitive information.
- How deep it goes
- Defines access controls, governance, encryption, and compliance roles but does not detail protocol or implementation mechanics.
- Examples
- Uses source-system integrations, data pipelines, access-rights frameworks, and encryption for stored and transferred data.
- What you can do after
- Operate enterprise data interactions with defined access rights, protected data flows, and compliance checks.
Read how Generative AI in Action explains authentication and authorization →
Related concepts
- aaa frameworkpart of · The AAA framework is an access-control model comprising authentication, authorization, and accounting for verifying identity, controlling access, and recording resource usage.
- team membershipuses · Team membership is the association of a person or other principal with a team that determines participation, resources, or permissions available through that team.
- Spring Securityimplemented by · Spring Security is a Spring framework for implementing application authentication, authorization, access control, and protection against common security threats.
- AI agentconfigures · An AI agent is a computational system that uses artificial intelligence to interpret information, select actions, and pursue goals through interaction with an environment.
- API gatewayused by · An API gateway is an intermediary that provides an entry point for client requests to backend APIs or services and routes or otherwise mediates those requests.
- MCP serverconfigures · An MCP server is software that implements the Model Context Protocol to expose capabilities or information to compatible clients.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.