Authorization in Action

"Covers every aspect of building dynamic authorization systems. No AI architect should be without it.”
—Drummond Reed, Co-author of Self-Sovereign Identity

Underlying all software security is access control: deciding who can get into a system and what they can do once they enter. This book shows you how to streamline and automate access control by replacing static manually assigned permissions with a dynamic, Policy-Based Access Control (PBAC) model. Author and identity expert Phillip Windley frames authorization as a first-class citizen in your architecture and shows you how to use the intuitive Cedar policy language to integrate modern access control efficiently into both new and legacy applications.

Rather than relying on abstract theory, this practical guide uses the journey of a fictional corporation to demonstrate how policy-based access models succeed at scales where static models inevitably fail. You will watch the corporate systems transition from basic Access Control Lists (ACLs) to sophisticated, multi-tenant SaaS environments that include zero trust architectures, secure APIs, verifiable credentials, and AI agents. This single, continuous case study is grounded in famous real-world security collapses, such as the infamous Target data breach that illustrates the catastrophic consequences of weak authorization boundaries.

At the core of the book is the Cedar policy language, which makes it much easier to unify Role-Based (RBAC), Attribute-Based (ABAC), and Relationship-Based (ReBAC) access control into PBAC. The book describes typed schemas and how to write policies that are safe by construction, eliminating the common security risks of hard-coded runtime conditionals. As reviewer Michael Schleichardt of eHealth Experts GmbH points out, “By decoupling authorization logic from application code, you gain the ability to reduce operational overhead and adapt seamlessly to shifting regulatory compliance.”

Windley tackles cutting-edge security, including decentralized identity and AI. You’ll explore how to integrate cryptographically signed verifiable credentials using a “Trust Diamond” framework. Crucially, the book addresses agentic AI systems, introducing patterns like authorization before retrieval for Retrieval-Augmented Generation (RAG). Professor Yang Luo of Peking University notes, “This book provides excellent integration of real-world context, which makes dynamic decisions actually dynamic,” and ensures that LLMs operate strictly on authorized data.

Spanning 19 comprehensive chapters, Authorization in Action provides a complete roadmap from foundational access concepts to enterprise-level policy governance. The hands-on learning experience is deeply enhanced by practical appendices, including an end-to-end tutorial using Amazon Verified Permissions and live, executable agent demonstrations using the OpenClaw runtime. When you’ve finished, you’ll have mastered a battle-tested toolkit of reusable patterns ready to secure access dynamically to your APIs, microservices, and distributed cloud systems.

What's inside

• Unify RBAC, ABAC, and ReBAC into a single PBAC framework
• Write secure, statically validated policies using the Cedar language
• Implement robust zero trust security controls across distributed microservices
• Authorize autonomous AI agents and protect sensitive RAG workflows

About the reader

For IT professionals, software architects, security engineers, and product managers who want to build secure, scalable systems.

About the author

Phillip J. Windley is the co-founder of the Internet Identity Workshop and was a Senior Software Development Manager at AWS Identity. His deep enterprise experience in cloud-native identity systems makes him a premier authority on modern, policy-based access control architectures.

Table of Contents

1 Why authorization matters: Securing access in a digital world
2 Understanding digital identity
3 Authentication: Who are you?
4 Authorization: What can you do?
5 Static authorization models
6 Dynamic authorization models
7 The building blocks of policy
8 Policy languages and frameworks
9 Implementing policies with Cedar
10 Policy as code: Effective authorization policies
11 Authorization for APIs
12 Authorization context
13 Using policy engines with existing systems
14 Policy governance
15 Security, zero trust, and authorization
16 Using verifiable credentials for authorization
17 AI in policy practice
18 Authorization for AI agents
19 Authorization as strategy