WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • May 8, 2024

Un-complicate authorization maintenance

Alex Olivier

Are hardcoded permissions bottlenecking your microservices? Discover how decoupling authorization into version-controlled, stateless sidecars eliminates technical debt and simplifies compliance.

Pause
Mute Enter Fullscreen
#1 about 4 min

Navigating the complexities of authorization maintenance in applications

Engineers frequently rebuild complex access control layers as product and data requirements scale.

#2 about 5 min

Differentiating authentication and authorization in modern web applications

While identity providers handle user verification, the application must natively govern valid resource operations.

#3 about 4 min

Managing early authorization logic with hardcoded roles and tiers

Simple conditional statements handle basic roles but struggle as product packaging complexity increases.

#4 about 4 min

Adapting access controls for regional data privacy regulations

Compliance events like GDPR require adding geographical condition checks across scattered application code.

#5 about 4 min

Scaling permissions for enterprise directory synchronization needs

Large organizations require fine-grained group policies that quickly bloat hardcoded matrix checks.

#6 about 3 min

Meeting compliance standards through structured permission audit logging

Frameworks like SOC2 and ISO necessitate injecting reliable audit logging into every permission decision.

#7 about 3 min

Challenges of replicating authorization logic across distributed microservices

Scattering duplicate permission checks across heterogeneous architectures increases maintenance overhead and risks logical inconsistencies.

#8 about 3 min

Adopting authorization capabilities as a decoupled external service

Centralized policy engines process user and resource contexts to return scalable access decisions.

#9 about 3 min

Defining business logic with static authorization policy repositories

Extracting condition evaluations into readable static files enables complex attribute-based access control without redeploying code.

#10 about 2 min

Enforcing request permissions via sidecar deployment patterns

Running local authorization containers ensures low-latency policy evaluation alongside application services without network overhead.

#11 about 7 min

Architecting a decoupled authorization request execution lifecycle

Delegated services evaluate dynamic policies centrally and guarantee standardized audit logs before returning decisions.

#12 about 4 min

Analyzing the benefits and trade-offs of decoupled policies

A dedicated policy layer supports versioned deployments and language independence despite adding infrastructure overhead.

#13 about 2 min

Overview of the Cerbos open-source authorization management engine

The Cerbos project offers a self-hosted platform for enforcing and testing complex access rules seamlessly.

#14 about 4 min

Applying authorization at the network versus application layers

Different architecture tiers require distinct tools tailored to specific transport protocols or complete business context.

#15 about 4 min

Validating access requirements through test-driven policy development workflows

Defining test assertions against static policy files prevents broken permissions from reaching production environments.

#16 about 3 min

Identifying signs of overly complex application authorization logic

Frequent code churn and massive repository diffs directly indicate a necessity to adopt decoupled access architectures.

#17 about 3 min

Leveling up collaboration with human-readable permission models

Separating logic from codebase syntax allows product and security teams to review authorization workflows safely.

#18 about 3 min

Enforcing multi-factor authentication inside dynamic authorization policies

Tracking secondary authentication signals during sensitive policy checks helps mitigate compromised primary session credentials.

#19 about 2 min

Leveraging community-driven solutions for scalable application access control

Open-source projects provide fully functional core authorization engines as flexible alternatives to expensive proprietary platforms.

#20 about 4 min

Transitioning childhood technological passions into professional programming careers

Building complex scaled systems during early personal projects establishes foundational expertise for distributed computing challenges.

Matching moments

1:32 min

Decoupling business logic with policy as code

Anderson Dadario +1 · LIVE

2:06 min

Identifying challenges of hardcoding authorization logic

Halil Özkan Halil Özkan · World Congress 2025

1:14 min

Offloading authorization routing to service meshes and gateways

Halil Özkan Halil Özkan · World Congress 2025

50 sec

Evaluating common authentication and custom authorization challenges

Anderson Dadario +1 · LIVE

1:11 min

Centralizing authorization oversight and system security traceability

Anderson Dadario +1 · LIVE

5:25 min

Designing granular permission architectures for autonomous browser based agents

Tarek Ziadé · Coffee With Developers

More from WeAreDevelopers LIVE

WeAreDevelopers LIVE - Is CSS Catching Up to Flash? thumbnail
1:03:33
10 days ago

WeAreDevelopers LIVE - Is CSS Catching Up to Flash?

Chris Heilmann, Daniel Cranney, Bramus Van Damme

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail
1:21:17
17 days ago

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof Cieślak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail
4:23
19 days ago

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Open Source Agent Toolkits thumbnail
1:00:38
24 days ago

WeAreDevelopers LIVE - Open Source Agent Toolkits

Chris Heilmann, Daniel Cranney, Eddie Jaoude

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail
6:16
26 days ago

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail
5:46
about 1 month ago

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

Related videos

Decoupled Authorization using Policy as Code thumbnail
32:16
LIVE • almost 6 years ago

Decoupled Authorization using Policy as Code

Anderson Dadario, Denys Vitali

Keymate – Modern Authorization for Developers thumbnail
6:04
World Congress 2025 • about 1 year ago

Keymate – Modern Authorization for Developers

Halil Özkan

Policy as [versioned] code - you're doing it wrong thumbnail
45:57
LIVE • almost 4 years ago

Policy as [versioned] code - you're doing it wrong

Chris Nesbitt-Smith

Full-stack role-based authorization in 45 minutes thumbnail
43:12
JS Congress • almost 5 years ago

Full-stack role-based authorization in 45 minutes

Bartosz Pietrucha

The day the chatbot asked for sudo thumbnail
27:48
World Congress 2026 Europe • 3 months ago

The day the chatbot asked for sudo

Alex Olivier

Monoskope: Developer Self-Service Across Clusters thumbnail
31:48
LIVE • almost 5 years ago

Monoskope: Developer Self-Service Across Clusters

Jan Steffen

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.