WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • May 8, 2024

Un-complicate authorization maintenance

Alex Olivier

Are hardcoded permissions bottlenecking your microservices? Discover how decoupling authorization into version-controlled, stateless sidecars eliminates technical debt and simplifies compliance.

Pause
Mute Enter Fullscreen
#1 about 4 min

Navigating the complexities of authorization maintenance in applications

Engineers frequently rebuild complex access control layers as product and data requirements scale.

#2 about 5 min

Differentiating authentication and authorization in modern web applications

While identity providers handle user verification, the application must natively govern valid resource operations.

#3 about 4 min

Managing early authorization logic with hardcoded roles and tiers

Simple conditional statements handle basic roles but struggle as product packaging complexity increases.

#4 about 4 min

Adapting access controls for regional data privacy regulations

Compliance events like GDPR require adding geographical condition checks across scattered application code.

#5 about 4 min

Scaling permissions for enterprise directory synchronization needs

Large organizations require fine-grained group policies that quickly bloat hardcoded matrix checks.

#6 about 3 min

Meeting compliance standards through structured permission audit logging

Frameworks like SOC2 and ISO necessitate injecting reliable audit logging into every permission decision.

#7 about 3 min

Challenges of replicating authorization logic across distributed microservices

Scattering duplicate permission checks across heterogeneous architectures increases maintenance overhead and risks logical inconsistencies.

#8 about 3 min

Adopting authorization capabilities as a decoupled external service

Centralized policy engines process user and resource contexts to return scalable access decisions.

#9 about 3 min

Defining business logic with static authorization policy repositories

Extracting condition evaluations into readable static files enables complex attribute-based access control without redeploying code.

#10 about 2 min

Enforcing request permissions via sidecar deployment patterns

Running local authorization containers ensures low-latency policy evaluation alongside application services without network overhead.

#11 about 7 min

Architecting a decoupled authorization request execution lifecycle

Delegated services evaluate dynamic policies centrally and guarantee standardized audit logs before returning decisions.

#12 about 4 min

Analyzing the benefits and trade-offs of decoupled policies

A dedicated policy layer supports versioned deployments and language independence despite adding infrastructure overhead.

#13 about 2 min

Overview of the Cerbos open-source authorization management engine

The Cerbos project offers a self-hosted platform for enforcing and testing complex access rules seamlessly.

#14 about 4 min

Applying authorization at the network versus application layers

Different architecture tiers require distinct tools tailored to specific transport protocols or complete business context.

#15 about 4 min

Validating access requirements through test-driven policy development workflows

Defining test assertions against static policy files prevents broken permissions from reaching production environments.

#16 about 3 min

Identifying signs of overly complex application authorization logic

Frequent code churn and massive repository diffs directly indicate a necessity to adopt decoupled access architectures.

#17 about 3 min

Leveling up collaboration with human-readable permission models

Separating logic from codebase syntax allows product and security teams to review authorization workflows safely.

#18 about 3 min

Enforcing multi-factor authentication inside dynamic authorization policies

Tracking secondary authentication signals during sensitive policy checks helps mitigate compromised primary session credentials.

#19 about 2 min

Leveraging community-driven solutions for scalable application access control

Open-source projects provide fully functional core authorization engines as flexible alternatives to expensive proprietary platforms.

#20 about 4 min

Transitioning childhood technological passions into professional programming careers

Building complex scaled systems during early personal projects establishes foundational expertise for distributed computing challenges.

Matching moments

1:32 min

Decoupling business logic with policy as code

Anderson Dadario +1 · LIVE

2:41 min

Fragmentation of authorization logic across modern architectures

Alex Olivier Alex Olivier · World Congress 2026 North America

2:06 min

Identifying challenges of hardcoding authorization logic

Halil Özkan Halil Özkan · World Congress 2025

1:14 min

Offloading authorization routing to service meshes and gateways

Halil Özkan Halil Özkan · World Congress 2025

50 sec

Evaluating common authentication and custom authorization challenges

Anderson Dadario +1 · LIVE

1:11 min

Centralizing authorization oversight and system security traceability

Anderson Dadario +1 · LIVE

More from WeAreDevelopers LIVE

WeAreDevelopers LIVE - Tech Education in Two Languages thumbnail
1:00:18
3 days ago

WeAreDevelopers LIVE - Tech Education in Two Languages

Daniel Cranney, Roxy Rodriguez-Becker

WeAreDevelopers LIVE - Playing in Production thumbnail
1:06:40
9 days ago

WeAreDevelopers LIVE - Playing in Production

Andrew MacLean, Daniel Cranney, Christian Heilmann

WeAreDevelopers LIVE - Is CSS Catching Up to Flash? thumbnail
1:03:33
23 days ago

WeAreDevelopers LIVE - Is CSS Catching Up to Flash?

Chris Heilmann, Daniel Cranney, Bramus Van Damme

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail
1:21:17
about 1 month ago

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof Cieślak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail
4:23
about 1 month ago

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Open Source Agent Toolkits thumbnail
1:00:38
about 1 month ago

WeAreDevelopers LIVE - Open Source Agent Toolkits

Chris Heilmann, Daniel Cranney, Eddie Jaoude

Upcoming sessions on this topic

Open session

How Google built a Consistent, Global Authorization System with Zanzibar (and you can too!)

  • Sohan Maheshwar

    AuthZed

    Lead Developer Advocate

Open session

Beware of Strangers Bearing Code: Open Source Trust in the Agent Era

  • Vikram Vaswani

    Consultant

Open session

Supply Chain Security for the Everyday Engineer

  • Pradumna Saraf

    Kestra Technologies

    Quality Assurance Engineer

Open session

Shipping MCP to Real Users: Scaling, Auth, and the PII Leak You Didn't See Coming

  • Hadar Geva

    Myop

    CTO & Co-founder

Open session

Autopsy of an Autonomous Incident: When the Agent Made It Worse

  • Navin Pai

    StackGen

    Director of Engineering

Open session

From Prompt Engineering to Harness Engineering: Building Observable and Governed GenAI Systems

  • Lakshmi Devi Prakash

    JPMorgan Chase

    VP, Applied AI/ML Lead

Related videos

It passed auth, then production caught fire thumbnail
22:59
World Congress 2026 North America • 15 days ago

It passed auth, then production caught fire

Alex Olivier

Decoupled Authorization using Policy as Code thumbnail
32:16
LIVE • almost 6 years ago

Decoupled Authorization using Policy as Code

Anderson Dadario, Denys Vitali

Keymate – Modern Authorization for Developers thumbnail
6:04
World Congress 2025 • about 1 year ago

Keymate – Modern Authorization for Developers

Halil Özkan

Policy as [versioned] code - you're doing it wrong thumbnail
45:57
LIVE • almost 4 years ago

Policy as [versioned] code - you're doing it wrong

Chris Nesbitt-Smith

Full-stack role-based authorization in 45 minutes thumbnail
43:12
JS Congress • almost 5 years ago

Full-stack role-based authorization in 45 minutes

Bartosz Pietrucha

The day the chatbot asked for sudo thumbnail
27:48
World Congress 2026 Europe • 3 months ago

The day the chatbot asked for sudo

Alex Olivier

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.