Policy-based access control
Policy-based access control is an authorization model that determines access by evaluating defined policies against identities, resources, actions, attributes, and context.
Authorization in Action
Policy-based authorization determines access from explicitly defined rules or policies evaluated against identities, resources, actions, and conditions.
- How it is used
- Enables fine-grained, dynamic authorization by evaluating external policies for access requests across applications and services.
- How deep it goes
- Explains runtime policy evaluation and hybrid RBAC, ABAC, and ReBAC inputs, while deferring policy-language and engine implementation details.
- Examples
- Uses document sharing, external counsel, SaaS tenant isolation, managed devices, IoT deployments, and AI-agent tool constraints.
- What you can do after
- Build it from scratch by externalizing access decisions into runtime-evaluated policies using roles, attributes, relationships, and context.
Read how Authorization in Action explains policy-based access control →
Building Web APIs with ASP.NET Core
Policy-based access control is an authorization model that evaluates configurable requirements and handlers, including arbitrary logic over a principal's claims.
- How it is used
- Deploys configurable authorization policies when claim presence or simple values cannot express the required security rule.
- How deep it goes
- Explains policy declaration, built-in assertions, and custom requirement handlers, but stops short of implementing handler classes.
- Examples
- Uses ModeratorWithMobilePhone and MinAge18 policies with RequireClaim, RequireAssertion, and the Authorize attribute.
- What you can do after
- Apply it via ASP.NET Core authorization policies and select those policies on protected endpoints.
Read how Building Web APIs with ASP.NET Core explains policy-based access control →
Related concepts
- authorization modelkind of · An authorization model is a formal scheme that represents authority and determines whether subjects may perform actions on resources.
- Cedaraddressed by · Cedar is an open-source declarative policy language and evaluation engine for expressing and evaluating fine-grained authorization and access-control policies.
- policy engineuses · A policy engine is a software component that evaluates policies against requests, resources, actions, or other inputs and produces decisions or enforcement outcomes.
- policyuses · A policy is a rule, strategy, or mapping that governs or determines decisions, actions, permissions, or behavior under specified conditions.
- authorizationkind of · Authorization is the determination and enforcement of rules governing which subjects may access resources or perform operations.
- security perimetercontrasts with · A security perimeter is a boundary separating protected systems, resources, or users from untrusted surroundings and controlling access between them.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.