Episode 224: We Told You Authorization Matters
September 15, 2026 · 2 min read
We had the answer to authorization 20 years ago. Most organizations just never implemented it properly. From XACML to UMA to Zero Trust to APIs, microservices, and now AI agents, we'll talk through why that gap persists, what we've learned watching it play out, and why the AI era finally makes dynamic authorization impossible to skip.
#Speakers
- Host: Mike Schwartz, Founder/CEO Gluu
- Guest: David Brossard, Chief Technology Officer at Axiomatics
#Homework
- XACML Wikipedia Page
- 2011 Kuppinger Cole Awards >The award for the most influential standardization effort goes to OASIS and the XACML TC (Technical Committee) for the work on XACML 3.0, an important standard driving the externalization of security out of application for centralized management and control.
- UMA Grant and UMA Federated Authz
- 2014 Kuppinger Cole Awards >The award for Best Innovation/New Standard in Information Security in 2014 goes to Kantara Initiative for the UMA (User Managed Access) standard. This new standard allows users to regain control over their data and has a significant potential for improving privacy on the Internet.
- Authorization in Action by Phil Windley Foreward by Sarah Cecchetti
- Google Beyond Zero Architecture Blog
#Takeaways
- We're never going to get 100% developer adoption of policy engines. Developers who don't use policy engines will need to do the hard work: make sure authz decisions are properly logged, make sure evidence is collected. Not using an external policy engine also reduces the quality of the evidence because the decision, exercise of the capability and observation functions are all provided by the same entity.
- Perhaps adoption of AuthZen faces hurdles because developers don't seem to care about the shape of the request. OpenFGA, SpiceDB and OPA are reporting low usage of AuthZen interfaces because the end-users seem to prefer their purpose-built authz request shapes. Mike also raised lack of agreement on the contents of the authz request, and even to the extent that profiles are developed, if they'll be able to meet the actual requirements for federated trust.
- Google's Beyond Zero architecture whose first principal specifies "resource and action-based security", are advocating for capabilities as the unit of governance.
- Policy store versioning and distribution is very much a challenge for the creation of strong evidence.
- New access-control models need a corresponding governance model. Enterprises must govern attributes, policy versions, distribution, decisions, and evidence—not merely replace RBAC with another “BAC.”