Architecting Application Authorisation

In the modern digital landscape, application authorisation has evolved from a simple gatekeeper to a complex, nuanced system crucial for security, user experience, and compliance. Gone are the days of basic "yes/no" access controls; today's applications demand granular permissions, delegated authority, and seamless integration across diverse platforms. Architecting application authorisation effectively requires a deep understanding of authentication flows, permission models like RBAC and ABAC, and technologies like OAuth 2.0 and OpenID Connect. This guide dives into the critical considerations and best practices for building robust, scalable, and user-friendly authorisation architectures, empowering you to secure your applications without compromising usability or innovation.

OPA

• https://www.openpolicyagent.org/docs/latest/
• https://sangkeon.github.io/opaguide/
• https://github.com/StyraInc/awesome-opa
• https://docs.styra.com/apps/advanced-architecture

Microservices

• https://www.manning.com/books/microservices-security-in-action
• https://cheatsheetseries.owasp.org/cheatsheets/Microservices_Security_Cheat_Sheet.html

UI

• https://docs.aws.amazon.com/prescriptive-guidance/latest/saas-multitenant-api-access-authorization/opa-ui-filtering-examples.html


• https://pongzt.com/post/opa-ui/

Within browser

• https://medium.com/@robertgartman/enforce-policies-in-the-browser-with-open-policy-agent-22d8e32fbfb6
• https://medium.com/@robertgartman/opa-angular-policy-as-code-in-the-browser-7bb3e5a8f60c

What is ABAC

• https://www.permit.io/blog/what-is-abac
• https://www.cerbos.dev/features-benefits-and-use-cases/abac

Examples:

• https://github.com/StyraInc/entitlements-samples
• https://developer.gs.com/blog/posts/using-entitlements-for-privileged-access-to-apis-and-applications-in-a-cloud-environment
• https://developer.gs.com/blog/posts/scaling-opa-for-oces