Authorization Academy

Authorization is a critical element of every application, but the problem is: there’s limited concrete material available for developers on how to build authorization into their app. To help developers build these systems and features, we built Authorization Academy.

This chapter shows how authorization fits into a typical application, and how to think about architecting the authorization system itself. To illustrate the concepts, we walk through an example application and the life of a request.

Introducing authorization models – ways to structure authorization code and guide implementation. These models start simply, but can grow with changing requirements. In this section we cover four models of role-based access control and show how to implement each one.

In this chapter, we'll explore attribute-based access control (ABAC), which is an access control framework that assigns permissions based on attributes. We'll explain the use cases for ABAC, and how it can allow for more fine-grained control.

In this chapter we’ll look at relationship-based authorization models. We’ll show you how to implement data ownership, parent-child resources, groups, and hierarchies. We’ll also explain centralized authorization services like Google Zanzibar, and share the Golden Rule for building authorization services.

This chapter covers enforcement. We provide a model for determining where to enforce authorization, what you should be enforcing at those places, how to connect enforcement to the decision mechanism, and what to do with the decision.

In a microservice architecture, you'll need to share authorization data between your services. There are many ways to do that! This chapter explains your options for authorization in microservices and how to decide between them.

LLMs are powerful. They're also unpredictable, fast, and tireless. When you give them access to sensitive data and tools, it's both more important and more difficult than ever to get authorization right. This chapter defines a mental model for authorizing LLM applications and applies it to LLM features like RAG and Agents.