Authorization is a critical element of every application, but the problem is: there’s limited concrete material available for developers on how to build authorization into their app. To help developers build these systems and features, we built Authorization Academy.

This chapter shows how authorization fits into a typical application, and how to think about architecting the authorization system itself. To illustrate the concepts, we walk through an example application and the life of a request.

Introducing authorization models – ways to structure authorization code and guide implementation. These models start simply, but can grow with changing requirements. In this section we cover four models of role-based access control and show how to implement each one.

In this chapter we’ll look at relationship-based authorization models. We’ll show you how to implement data ownership, parent-child resources, groups, and hierarchies. We’ll also explain centralized authorization services like Google Zanzibar, and share the Golden Rule for building authorization services.

This chapter covers enforcement. We provide a model for determining where to enforce authorization, what you should be enforcing at those places, how to connect enforcement to the decision mechanism, and what to do with the decision.

In a microservice architecture, you'll need to share authorization data between your services. There are many ways to do that! This chapter explains your options for authorization in microservices and how to decide between them.