Скачать или смотреть Fine-Grained Authorization: Developer Tradeoffs | Gabriel Manor @ Authcon 2025

In this talk, Gabriel Manor, Head of Developer Relations at Permit.io, breaks down the practical tradeoffs developers face when implementing fine-grained authorization. From choosing between conditions and relationships to navigating policy complexity and data consistency, Gabriel shares real-world scenarios and clear models to help you design scalable, secure authorization systems.

📌Explore AuthCon: https://www.authcon.io/

⏱️ Timestamps:

00:00 – Tech setup and intro
01:21 – Background: Authorization vs. Authentication
02:15 – The mistaken analogy between authN and authZ
03:08 – Key differences between authentication and authorization
04:24 – Intro to coarse-grained authorization (RBAC)
05:16 – Why fine-grained authorization is becoming necessary
06:10 – Trend 1: Cloud-native, microservice-based architectures
06:48 – Trend 2: The shift to data-driven applications
07:34 – Trend 3: Continuous deployment and CI/CD pipelines
08:25 – Trend 4: Evolving user expectations and secure collaboration
09:13 – Coarse-grained vs. fine-grained: the check() function breakdown
10:31 – Adding more context with attributes and relationships
11:36 – Two core models: conditions vs. relationships
12:00 – Attribute-based access control (ABAC) explained
13:21 – Relationship-based access control (ReBAC) explained
14:42 – Google Zanzibar and its influence
15:05 – Authorization engines: OpenFGA, Cedar, OPA
15:38 – Policy decisions and the three key inputs: policy, data, and context
16:35 – Managing data sync with OPAL
17:25 – Tradeoff 1: Consistency models (strong, eventual, read-your-write)
19:09 – Real-world example from an HMO client
20:00 – Challenge: mixing conditions and relationships
21:15 – Tradeoff 2: Complex policy code in Rego
22:14 – Tradeoff 3: Complex enforcement logic in the app
24:05 – Tradeoff 4: Data manipulation for graph-based models
25:57 – Summary of the three tradeoffs
26:37 – How Permit.io simplifies modeling with first-level conditional relationships
27:28 – Final takeaways and best practices
28:21 – Closing remarks and article reference



🔔 Subscribe for more AuthCon speaker insights