Continuous authorization

As explained in Authorization in Action

Continuous authorization is the repeated evaluation of access requests in context rather than granting durable access after a single authentication or authorization event.

When users, devices, workloads, and services operate across cloud systems, mobile environments, SaaS applications, and external collaborations, network location no longer provides reliable trust. Continuous authorization replaces inherited trust with repeated access evaluation based on identity, device, conditions, and purpose. section 15.1

Authorization is continuous when access is evaluated every time it matters rather than granted durably after one authentication or authorization event. Decisions can incorporate changing relationships, real-time context, actions by people or services, device posture, operational signals, and policy. section 15.1 section 19.9

A practical transition toward continuous authorization includes:

• Make an unclear or inconsistently enforced permission visible. section 19.9
• Externalize one policy domain and evaluate it consistently. section 19.9
• Govern identity, role, attribute, relationship, device, and operational signals so they remain defined, validated, and current. section 15.1
• Evaluate the policy at runtime using conditions that reflect how the system actually operates, then learn from the outcomes. section 19.9

ACME's collaboration platform

ACME began with document sharing, but access decisions grew beyond simple role checks. Relationships, attributes, and real-time context increasingly shaped behavior across services, teams, and customer interactions. The organization improved incrementally by making decisions consistent and integrating them with identity and policy capabilities. section 19.0

Figure 15.1 Why the perimeter model fails in modern environments. In the traditional model (left), a firewall defined a clear boundary, and anything inside the perimeter was implicitly trusted. In modern environments (right), cloud services, mobile work, SaaS applications, and external collaborators eliminate meaningful boundaries.

Contrasts a firewall-centered model, where internal location implies trust, with modern environments whose cloud, mobile, SaaS, and external boundaries make that assumption unreliable. section 15.1

How Authorization in Action covers it

How deep it goes

Explains contextual runtime evaluation and gives incremental adoption steps, stopping short of specifying a particular implementation technology.

Examples

Uses ACME document collaboration, perimeter failure, changing relationships, and incremental policy externalization as teaching examples.

What it assumes

Assumes reliable authentication and identity data while teaching how device, relationship, attribute, and operational signals support authorization.

What you can do after

Apply it by externalizing one access policy, governing its signals, evaluating it at runtime, and extending the approach incrementally.

How it connects

Connects zero trust with identity, device posture, policy, context, governance, delegation, and runtime evaluation.

liveBookmanning.com

Read Authorization in Action on liveBook Get the book at manning.com

Related concepts

• policyuses · A policy is a rule, strategy, or mapping that governs or determines decisions, actions, permissions, or behavior under specified conditions.
• contextuses · Context is the surrounding information, state, or circumstances that condition how an entity, event, or task is interpreted or how a system behaves.
• zero-trust networkinguses · Zero-trust networking is a security architecture that grants no implicit trust based on network location or prior access and verifies and authorizes access requests explicitly.
• edgeuses · An edge is a graph connection between two vertices that represents a relationship and may be directed, labeled, or weighted.
• runtime evaluationuses · Runtime evaluation is the assessment of current inputs, context, or state during execution to determine a result or action.
• governanceuses · Governance is the system of policies, roles, decision rights, processes, controls, and oversight through which an organization, system, or activity is directed and held accountable.

This explainer was generated by Manning's knowledge graph from the text of Authorization in Action. The section links point to the parts of the book it draws on.