Authorization in Action
Build policy-based access control for zero trust, APIs, SaaS, and AI agents
by Phillip J. Windley, PhD, Executive Director, IIW Foundation
https://www.amazon.com/Authorization-Action-Phil-Windley/dp/1633435172/
https://www.manning.com/books/authorization-in-action
Publication Date: 2026-09-22
Pages: 464
https://www.linkedin.com/in/windley/
University of California, Davis, Ph.D., Computer Science (1988-1990)
University of California, Davis, MS, Computer Science (1986-1988)
University of Idaho, BS, Metallurgical Engineeering (1972-1976)
Also see my companion post on LinkedIn.
My Amazon Review: 5-stars
https://www.amazon.com/review/R27MQD0ML85ELS/
------------------------------------------------------------------------------------------------------------
Comprehensive, Exceptionally Well-Organized, and Well-Written
An exceptionally well-organized, and well-written book, on a critically important topic.
This book is excellent for the authorization neophyte, as well as the experienced IT professional.
Chapters 8-19 will be of particular interest for folks who may have no previous experience with policy languages and frameworks, and who may be tackling the particular authorization challenges of Zero Trust, AI Agents, and Policy Governance.
------------------------------------------------------------------------------------------------------------
Additional Notes:
Cedar Open Source Policy Language and Evaluation Engine
https://arxiv.org/abs/2403.04651
Abstract:
"Cedar is a new authorization policy language designed to be ergonomic, fast, safe, and analyzable. Rather than embed authorization logic in an application's code, developers can write that logic as Cedar policies and delegate access decisions to Cedar's evaluation engine. Cedar's simple and intuitive syntax supports common authorization use-cases with readable policies, naturally leveraging concepts from role-based, attribute-based, and relation-based access control models. Cedar's policy structure enables access requests to be decided quickly. Cedar's policy validator leverages optional typing to help policy writers avoid mistakes, but not get in their way. Cedar's design has been finely balanced to allow for a sound and complete logical encoding, which enables precise policy analysis, e.g., to ensure that when refactoring a set of policies, the authorized permissions do not change. We have modeled Cedar in the Lean programming language, and used Lean's proof assistant to prove important properties of Cedar's design. We have implemented Cedar in Rust, and released it open-source. Comparing Cedar to two open-source languages, OpenFGA and Rego, we find (subjectively) that Cedar has equally or more readable policies, but (objectively) performs far better."
https://cedarpolicy.com/en
"Cedar is an open source policy language and evaluation engine. Cedar enables developers to express fine-grained permissions as easy-to-understand policies enforced in their applications, and decouple access control from application logic. Cedar supports common authorization models such as role-based access control and attribute-based access control. It is the first policy language built from the ground up to be verified formally by using automated reasoning, and tested rigorously using differential random testing."
https://github.com/cedar-policy
https://github.com/cedar-policy/cedar
Implementation of the Cedar Policy Language
License: Apache-2.0
99.8 Rust
Welcome to the Cedar policy language
https://docs.cedarpolicy.com/
Cedar terms and concepts
https://docs.cedarpolicy.com/overview/terminology.html
Enforce least-privilege authorization in multi-agent AI chains using Cedar
https://aws.amazon.com/blogs/security/enforce-least-privilege-authorization-in-multi-agent-ai-chains-using-cedar/
AWS re:Invent 2024 - Dynamic security at scale: Cedar policies for continuous authorization (SEC207)
https://www.youtube.com/watch?v=n80yLNqpTbk
"Join the CTO of StrongDM for a live demo showcasing how Cedar policies and continuous authorization enable fine-grained control over your systems. With real-world experience as a Cedar adopter, StrongDM uses context signals across your enterprise to enforce policies that block suspicious or unsanctioned actions in real time. This lightning talk highlights how StrongDM’s Zero Trust-based approach ensures that risk assessments dynamically determine access and the appropriate level of friction for critical actions. Discover how Cedar's flexibility and precision help you build resilient security measures that adapt to evolving threats while maintaining an optimal user experience. This presentation is brought to you by StrongDM, an AWS Partner."
