Authorization in Action

Authorization in Action focuses on one of the most important—and most overlooked—parts of modern software security: deciding who can do what, when, and under which conditions. Phillip J. Windley brings authorization out of the background and treats it as a first-class architectural concern, especially for systems that need to support zero trust security, APIs, SaaS applications, and AI agents.

Modern authorization, explained clearly

This book takes readers from the foundations of digital identity and authentication into the mechanics of access control itself. It starts with the limits of older, static approaches such as ACLs and RBAC, then builds toward dynamic models including ReBAC, ABAC, and policy-based access control. That progression gives the subject real context: instead of treating authorization as a single rule-check, the book shows how it becomes part of a living system of policy, identity, and trust.

From theory to policy-driven practice

One of the book’s most useful threads is its emphasis on policy as code and policy as data. The discussion of Cedar and policy structure helps connect abstract access rules to something implementable, testable, and maintainable. For teams working in distributed environments, that matters. Authorization decisions need to scale with systems, not fight against them.

Built for today’s security realities 🔐

Beyond core access-control models, the book addresses topics that matter in current architectures: authorization context, policy governance, zero trust, verifiable credentials, and AI-driven systems. That makes it especially relevant for architects, security engineers, and developers who are trying to secure modern application stacks without relying on hard-coded permission logic.

What kind of reader will appreciate it?

• Software architects designing permission systems
• Security teams working on zero trust or policy governance
• Developers implementing authorization in APIs or SaaS products
• Readers who want a practical, systems-level view of modern access control

If you need a serious, technically grounded ebook on authorization that goes well beyond basic role checks, Authorization in Action is built for that job.