Designing Authorization Architecture
1. Designing Role-Based Access Control (RBAC)
| Element | Detail |
|---|---|
| Role | Named set of permissions |
| User-Role | Many-to-many |
| Role-Permission | Many-to-many |
| Pros | Simple, auditable |
| Cons | Role explosion in fine-grained orgs |
2. Designing Attribute-Based Access Control (ABAC)
| Component | Detail |
|---|---|
| Subject attrs | role, dept, clearance |
| Resource attrs | owner, classification, tag |
| Action / Env | read/write; time, IP |
| Policy | Rules combining attrs (XACML, OPA Rego) |
| Use case | Fine-grained, dynamic |
3. Designing Permission Management System
| Aspect | Detail |
|---|---|
| Naming | resource:action (e.g., invoice:read) |
| Wildcards | invoice:* admin:* |
| Grouping | Permission sets / roles |
| Self-service | UI for admins to manage |
4. Designing Policy-Based Access Control
| Tool | Detail |
|---|---|
| OPA / Rego | Decoupled policy engine |
| Cedar (AWS) | Policy language for fine-grained |
| XACML | Standard but verbose |
| Casbin | Lightweight library |
| PDP / PEP / PIP / PAP | Decision / Enforcement / Info / Admin points |
5. Designing Resource-Based Authorization
| Pattern | Detail |
|---|---|
| Ownership check | resource.owner_id == user.id |
| ACL per resource | (user, resource, perm) |
| ReBAC (Zanzibar) | Relationships → permissions; SpiceDB, OpenFGA |
| Sharing model | Owner / editor / viewer |
6. Designing Hierarchical Roles
| Aspect | Detail |
|---|---|
| Inheritance | Admin ⊃ Manager ⊃ User |
| Cycle prevention | DAG only |
| Org hierarchy | Permissions cascade down org tree |
7. Designing Dynamic Authorization Rules
| Mechanism | Detail |
|---|---|
| Rule engine | Drools, easy-rules |
| Hot-reload policies | Pull from central store |
| Versioning | Track policy changes |
| Test sandbox | Dry-run before deploy |
8. Designing Authorization Caching
| Layer | Detail |
|---|---|
| Token claims | Embed roles/perms (cap size) |
| Local cache | Per-process LRU; short TTL |
| Redis cache | Decisions for resource:user |
| Invalidation | On role/permission change events |
9. Designing Fine-Grained Authorization
| Approach | Detail |
|---|---|
| Field-level | Mask columns per role |
| Row-level | WHERE clause filter per user |
| Operation-level | Per-method permission |
| ReBAC | Google Zanzibar-style relations |
10. Designing Authorization Audit Trail
| Field | Detail |
|---|---|
| Who | user_id, ip, device |
| What | Resource, action |
| Decision | Allow / Deny + matched policy |
| When | Timestamp |
| Storage | Append-only; SIEM ingest |
11. Designing OAuth2 Scopes
| Practice | Detail |
|---|---|
| Naming | resource.action (e.g., orders.read) |
| Granularity | Coarse for UX; fine for sensitive |
| Consent screen | Show requested scopes clearly |
| Down-scoping | Token exchange to narrower |
12. Designing Context-Aware Authorization
| Context | Detail |
|---|---|
| Time-of-day | Restrict admin ops to business hours |
| Geo / IP | Block / step-up from anomalous |
| Device posture | Managed device required |
| Risk score | Adaptive auth (deny / step-up) |