IAM building block · 3 min read
Authorization: deciding what is allowed
Short answer
Authorization decides whether an authenticated subject may perform an action on a resource; most systems combine roles (RBAC) for coarse grants with attribute-based rules (ABAC) for context such as ownership, amount or location, evaluated close to the resource on every request.
Key takeaways
- OAuth scopes limit what a client may do; they do not replace per-object authorization in your API.
- RBAC is simple to audit but leads to role explosion; ABAC handles context but needs good attribute data.
- Separate the decision (policy engine) from enforcement (API, gateway) so policies can change without code releases.
Authorization is where most real breaches of APIs and web applications happen. An attacker signs in with a legitimate low-privilege account and then reads or changes data they should not see, because some endpoint checked who they were but not what they were allowed to do.
What models are there?
Access control lists, role-based (RBAC), attribute-based (ABAC) and relationship-based (ReBAC) models, often combined.
| Model | Decision based on | Strength | Weakness |
|---|---|---|---|
| ACL | Per-object list of users | Simple, explicit | Hard to manage at scale |
| RBAC | User's roles | Easy to audit and explain | Roles multiply to cover exceptions |
| ABAC | Attributes and policies | Expresses context and rules | Needs reliable attribute data |
| ReBAC | Relationships in a graph | Natural for sharing, multi-tenancy | Graph must be kept consistent |
How does policy-based authorization work?
An enforcement point in the application sends the subject, action, resource and context to a decision point, which evaluates policies and returns permit or deny.
XACML 3.0, an OASIS standard since 2013, defined the vocabulary everyone still uses:
- PEP (Policy Enforcement Point): intercepts the request, asks, enforces.
- PDP (Policy Decision Point): evaluates policies.
- PIP (Policy Information Point): fetches missing attributes.
- PAP (Policy Administration Point): manages and tests policies.
XACML policies are XML; its JSON profile simplifies requests, and ALFA gives a more readable authoring syntax. Newer engines use other languages (Rego, Cedar) but the same split. See our overview of policy servers such as Axiomatics and entitlement management.
Where do OAuth scopes fit?
Scopes are coarse permissions granted to a client application, such as invoices:read; the API must still check whether this user may read this invoice.
A token with invoices:read tells the API that the client was allowed to request read access on the user's behalf. It says nothing about which invoices the user may see. That check needs the user's identity (sub), their tenant or organization, and your data. Look at what your tokens actually contain with the JWT Decoder; many carry far broader scopes and audiences than any one API needs.
Where should checks happen?
At every layer that exposes data, with the final, object-level check closest to the data.
- Gateway: token validity, scopes, rate limits.
- Service: function-level (may this role call this operation?) and object-level (may this user act on this record?).
- Data layer: tenant isolation, for example row-level security, as a backstop.
Deny by default. Centralize checks in middleware or a policy client so new endpoints inherit them. Write tests that try to access another user's objects; these catch the most common API bug, broken object level authorization.
How do I keep authorization manageable?
Keep roles few and meaningful, express exceptions as attribute rules, version and test policies, and review grants regularly.
Treat policies like code: in version control, reviewed, with unit tests for important decisions. Log decisions with enough context to explain them later. Connect role grants to provisioning and access reviews so they shrink when people move, as described in the provisioning guide.
Questions
What is the difference between RBAC and ABAC?
RBAC grants permissions to roles and roles to users. ABAC evaluates policies over attributes of the user, resource, action and environment, so it can express rules such as 'managers may approve expenses under 5,000 for their own department during business hours'.
Which policy engines are common besides XACML products?
Open Policy Agent with the Rego language, AWS's Cedar language, and relationship-based systems inspired by Google's Zanzibar paper, such as OpenFGA, are widely used. They follow the same decision and enforcement split as XACML.
What is ReBAC?
Relationship-based access control grants access from relationships between objects, such as 'user is editor of folder, document is in folder'. It suits document sharing and multi-tenant SaaS.