The Case for Centralizing Authorization
The Case for Centralizing Authorization
This whitepaper explores the business and technical reasons for centralizing authorization. We discuss the headwinds that organizations face when treating authorization as a central concern:
- Expressivity
- Performance
- Isolation
- Integration
Most importantly, we explore solutions that help organizations overcome these headwinds.
Fine-grained, real-time access control made easy
Support RBAC, ABAC, and ReBAC out of the box. Enforce in millisecond latency and with high availability
allowed {
ns := time.now_ns()
day := time.weekday(ns)
day == data.workdays[_]
}
Include environmental attributes in your policies
allowed {
input.user.properties.dept == "Sales"
}
Use any user-centric attributes in your policies
allowed {
ds.check({
"subject_type": "user",
"subject_id": input.user.id,
"relation": "manager",
"object_type": "user",
"object_id": input.resource.id
})
}
Make access decisions based on org-chart relationships
allowed {
ds.check({
"subject_type": "user",
"subject_id": input.user.id,
"relation": "can_read",
"object_type": "document",
"object_id": input.resource.id
})
}
Model your resource hierarchy and enforce fine-grained authorization
allowed {
ns := time.now_ns()
day := time.weekday(ns)
day == data.workdays[_]
}
Include environmental attributes in your policies
allowed {
input.user.properties.dept == "Sales"
}
Use any user-centric attributes in your policies
Make access decisions based on org-chart relationships
Model your resource hierarchy and enforce fine-grained authorization
allowed {
ns := time.now_ns()
day := time.weekday(ns)
day == data.workdays[_]
}
Include environmental attributes in your policies
- 1
- 2
- 3
- 4
The best of OPA and Zanzibar
Topaz is an open-source authorization system that allows you to combine RBAC, ABAC, and ReBAC as you see fit.
Centralized authorization system
Aserto is a unified access control system for your applications, services, and APIs