1 Why authorization matters: Securing access in a digital world

Authorization is presented as a foundational capability for modern digital systems, not merely a security checklist item. The chapter uses the Target breach to show how weak access boundaries can turn a compromised credential into a major incident, emphasizing the distinction between authentication—knowing who is making a request—and authorization—deciding what that entity is allowed to do. It also explains that digital identity systems exist to manage relationships by recognizing, remembering, and relating to people, services, devices, organizations, and even AI agents. In this view, authorization is central both to protecting systems and to enabling product features such as document sharing, tenant isolation, and delegated access.

The chapter argues that traditional authorization methods such as access control lists, groups, and roles are often too static for today’s distributed, multi-tenant, cloud-based environments. As systems grow, these approaches become difficult to scale, maintain, audit, and secure; they also struggle with contextual decisions involving time, location, device posture, consent, temporary access, or regulatory requirements. Dynamic authorization addresses these problems by evaluating access requests at runtime using explicit, machine-readable policies. Policy-based access control externalizes authorization logic from application code, making decisions more consistent, flexible, auditable, and aligned with zero trust principles, SaaS needs, IoT deployments, regulatory compliance, and emerging AI use cases.

The chapter also introduces two complementary ways to represent dynamic authorization: Policy as Code and Policy as Data. Policy as Code treats access rules like software, allowing them to be versioned, tested, reviewed, and deployed through normal engineering practices. Policy as Data stores relationships, attributes, permissions, or resource metadata in structured systems that policy engines can query when making decisions. Together, these approaches let organizations automate access management, reduce operational costs, improve onboarding and offboarding, support fine-grained customer experiences, adapt quickly to business changes, and strengthen compliance. The chapter concludes that dynamic authorization is a strategic architectural capability that helps organizations build systems that are safer, more adaptable, easier to govern, and better prepared for innovation.

Embedding access logic throughout application code (left) creates tight coupling. Externalizing authorization into a separate component (right) makes access policies explicit, decouples decision-making from application behavior, and enables scalable, auditable access control.

Dynamic authorization can represent policy in two complementary ways. On the left, Policy as Code stores machine-readable policies in a repository that the access logic evaluates at runtime. On the right, Policy as Data stores relationships and attributes in a structured data store that the same access logic uses to determine decisions. Both approaches externalize policy from the application while supporting different kinds of flexibility.

A relationship graph representing access to a Google document. Rather than use static ACLs, this model captures roles (like Owner, Editor, Viewer) as first-class relationships between users and resources. The graph also models hierarchical relationships (such as parent folders), enabling more flexible, general-purpose authorization logic that can be queried and evaluated dynamically.

As an organization grows, the number of access policies tends to increase faster than linearly. Though a small organization might manage with a simple, flat set of policies, larger organizations face compounding complexity due to team structures, regional compliance, and overlapping responsibilities, leading to superlinear policy growth.

• Poor access control can lead to severe security breaches, as seen in the Target breach, where attackers exploited weak authorization to access sensitive systems.
• Authorization is not just about security; it also enables key features in modern cloud applications, such as document sharing and multi-tenant access control.
• Traditional authorization methods like ACLs and RBAC are static and struggle with scalability, flexibility, maintainability, efficiency, auditability, and security.
• Dynamic authorization overcomes these challenges by using policies to make real-time, context-aware access decisions.
• Policy-based access control (PBAC) enables fine-grained authorization by externalizing access control logic, making it dynamic and adaptable to changing conditions.
• The shift toward zero-trust security models, SaaS applications, IoT, regulatory compliance, and AI-driven applications demands more flexible and scalable access control, making dynamic authorization essential.
• Policies can be represented as code or data, enabling both structured rule enforcement and flexible, real-time access adjustments.
• Treating policy as code allows version control, testing, and automation, while policy as data supports fine-grained, user-defined access controls.
• Organizations adopting dynamic authorization benefit from reduced operational costs, improved agility, enhanced security, and better customer experiences.
• Businesses can use dynamic authorization as a competitive advantage, enabling new product capabilities, faster compliance adaptation, and stronger security.
• Authorization is a strategic investment, not just a security measure—organizations that adopt policy-based access control gain efficiency, scalability, and security.

FAQ