liveBook · Manning

Team-based authorization model

As explained in Effective Platform Engineering

A team-based authorization model assigns principal permissions primarily through membership in a development team rather than through individual identity alone.

A team-based authorization model makes the development team the central authorization role: individuals authenticate, but permissions primarily follow team membership. Domain-bounded teams provide the organizational boundary for platform access, resources, and governance. section 4.3.3

Apply the model by:

  • Granting a developer access to the team’s platform and developer resources automatically when they join. section 4.3.3
  • Maintaining access control and governance around team resources rather than accumulating ad hoc individual permissions. section 4.3.3
  • Using a dedicated identity provider as an intermediary between authentication, authorization, and external systems of record. section 4.3.3
Figure 4.8 We want the IDP to be the go-between rather than the source of truth, and we will need to be able to customize the results from the authorization service.
A diagram of a diagram AI-generated content may be incorrect.

Shows the identity provider acting as a customizable intermediary rather than the sole source of authorization truth. section 4.3.3

How Effective Platform Engineering covers it

How deep it goes
Defines the team-centered model, explains automatic access and governance, and specifies the identity provider’s intermediary role.
Examples
Uses developer onboarding, automatic team-resource access, and an intermediary identity provider as concrete implementation examples.
What it assumes
Assumes individual authentication and distributed service teams, while establishing team-centered authorization and identity-provider mediation.
What you can do after
Operate/configure team-scoped platform access with automatic membership-based permissions and governed identity-provider integration.
How it connects
Connects authentication with authorization, domain-bounded teams, access control, governance, identity providers, and external systems of record.
Cover of Effective Platform Engineering
liveBookmanning.com
Read Effective Platform Engineering on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Effective Platform Engineering. The section links point to the parts of the book it draws on.