WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • May 8, 2024

Un-complicate authorization maintenance

Alex Olivier

Are hardcoded permissions bottlenecking your microservices? Discover how decoupling authorization into version-controlled, stateless sidecars eliminates technical debt and simplifies compliance.

Pause
Mute Enter Fullscreen
#1 about 4 min

Navigating the complexities of authorization maintenance in applications

Engineers frequently rebuild complex access control layers as product and data requirements scale.

#2 about 5 min

Differentiating authentication and authorization in modern web applications

While identity providers handle user verification, the application must natively govern valid resource operations.

#3 about 4 min

Managing early authorization logic with hardcoded roles and tiers

Simple conditional statements handle basic roles but struggle as product packaging complexity increases.

#4 about 4 min

Adapting access controls for regional data privacy regulations

Compliance events like GDPR require adding geographical condition checks across scattered application code.

#5 about 4 min

Scaling permissions for enterprise directory synchronization needs

Large organizations require fine-grained group policies that quickly bloat hardcoded matrix checks.

#6 about 3 min

Meeting compliance standards through structured permission audit logging

Frameworks like SOC2 and ISO necessitate injecting reliable audit logging into every permission decision.

#7 about 3 min

Challenges of replicating authorization logic across distributed microservices

Scattering duplicate permission checks across heterogeneous architectures increases maintenance overhead and risks logical inconsistencies.

#8 about 3 min

Adopting authorization capabilities as a decoupled external service

Centralized policy engines process user and resource contexts to return scalable access decisions.

#9 about 3 min

Defining business logic with static authorization policy repositories

Extracting condition evaluations into readable static files enables complex attribute-based access control without redeploying code.

#10 about 2 min

Enforcing request permissions via sidecar deployment patterns

Running local authorization containers ensures low-latency policy evaluation alongside application services without network overhead.

#11 about 7 min

Architecting a decoupled authorization request execution lifecycle

Delegated services evaluate dynamic policies centrally and guarantee standardized audit logs before returning decisions.

#12 about 4 min

Analyzing the benefits and trade-offs of decoupled policies

A dedicated policy layer supports versioned deployments and language independence despite adding infrastructure overhead.

#13 about 2 min

Overview of the Cerbos open-source authorization management engine

The Cerbos project offers a self-hosted platform for enforcing and testing complex access rules seamlessly.

#14 about 4 min

Applying authorization at the network versus application layers

Different architecture tiers require distinct tools tailored to specific transport protocols or complete business context.

#15 about 4 min

Validating access requirements through test-driven policy development workflows

Defining test assertions against static policy files prevents broken permissions from reaching production environments.

#16 about 3 min

Identifying signs of overly complex application authorization logic

Frequent code churn and massive repository diffs directly indicate a necessity to adopt decoupled access architectures.

#17 about 3 min

Leveling up collaboration with human-readable permission models

Separating logic from codebase syntax allows product and security teams to review authorization workflows safely.

#18 about 3 min

Enforcing multi-factor authentication inside dynamic authorization policies

Tracking secondary authentication signals during sensitive policy checks helps mitigate compromised primary session credentials.

#19 about 2 min

Leveraging community-driven solutions for scalable application access control

Open-source projects provide fully functional core authorization engines as flexible alternatives to expensive proprietary platforms.

#20 about 4 min

Transitioning childhood technological passions into professional programming careers

Building complex scaled systems during early personal projects establishes foundational expertise for distributed computing challenges.

Matching moments

1:32 min

Decoupling business logic with policy as code

Anderson Dadario +1 · LIVE

2:06 min

Identifying challenges of hardcoding authorization logic

Halil Özkan Halil Özkan · WWC 2025

1:14 min

Offloading authorization routing to service meshes and gateways

Halil Özkan Halil Özkan · WWC 2025

50 sec

Evaluating common authentication and custom authorization challenges

Anderson Dadario +1 · LIVE

1:11 min

Centralizing authorization oversight and system security traceability

Anderson Dadario +1 · LIVE

5:25 min

Designing granular permission architectures for autonomous browser based agents

Tarek Ziadé · Coffee With Developers

More from WeAreDevelopers LIVE

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail
5:43
5 days ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Node and Package Security thumbnail
1:08:30
5 days ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

WeAreDevelopers LIVE - Streaming HTML thumbnail
1:10:26
12 days ago

WeAreDevelopers LIVE - Streaming HTML

Chris Heilmann, Daniel Cranney, Jad Joubran

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe thumbnail
1:02:34
19 days ago

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe

Chris Heilmann, Daniel Cranney, Justin Halsall, Werner Jeschko, Nicole Jeschko, Mirco Tomić

WeAreDevelopers LIVE - Web Performance in an AI World thumbnail
1:07:59
26 days ago

WeAreDevelopers LIVE - Web Performance in an AI World

Chris Heilmann, Daniel Cranney

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko thumbnail
5:55
about 2 months ago

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

Open session

World Congress 2026 North America

It passed auth, then production caught fire

Alex Olivier

Co-founder & CPO @ Cerbos | OpenID AuthZEN Co-chair

Alex Olivier
Open session

World Congress 2026 North America

When Agents Became Users: Rearchitecting Identity and Permissions for AI at Scale

Dor Cohen, Yoav Gal

Dor Cohen
Yoav Gal
Open session

World Congress 2026 North America

Give the Agent a Budget, Not a Token

Sachin Malhotra

MTS @Anthropic

Sachin Malhotra
Open session

World Congress 2026 North America

Boring Failover: Predictable Region Recovery Across 5,000 Microservices

Garvit Kataria, Sahil Sabharwal

Garvit Kataria
Sahil Sabharwal
Open session

World Congress 2026 North America

Securing AI Agent Infrastructure: Identity, Attestation, and Trust at Scale

Abdel Fane

Founder of OpenA2A

Abdel Fane
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali

Related videos

Decoupled Authorization using Policy as Code thumbnail
32:16
LIVE • almost 6 years ago

Decoupled Authorization using Policy as Code

Anderson Dadario, Denys Vitali

Keymate – Modern Authorization for Developers thumbnail
6:04
WWC 2025 • 12 months ago

Keymate – Modern Authorization for Developers

Halil Özkan

Policy as [versioned] code - you're doing it wrong thumbnail
45:57
LIVE • almost 4 years ago

Policy as [versioned] code - you're doing it wrong

Chris Nesbitt-Smith

Full-stack role-based authorization in 45 minutes thumbnail
43:12
JS Congress • over 4 years ago

Full-stack role-based authorization in 45 minutes

Bartosz Pietrucha

The day the chatbot asked for sudo thumbnail
27:48
WWC Europe 2026 • about 1 month ago

The day the chatbot asked for sudo

Alex Olivier

Monoskope: Developer Self-Service Across Clusters thumbnail
31:48
LIVE • over 4 years ago

Monoskope: Developer Self-Service Across Clusters

Jan Steffen

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.