That's out of scope!
summary
Defines ABAC as fine-grained but often overkill; RBAC groups multiple permissions into roles; Auth0 can embed permissions in JWT so APIs can avoid separate permission lookups; scopes are OAuth 2.0/OpenID Connect delegation tokens granted by users and never elevate a user’s intrinsic permissions; prefer permissions for first‑party APIs and scopes only for third‑party delegation; warn that many scopes inflate token size, use resource:action naming, keep changes backward compatible and consider token invalidation when rolling out breaking scope changes.
AI-written summary · about
chapters (8)
- 0:00Intro
- 1:31What is Access Control
- 1:55Attributebased Access Control
- 5:09Rolebased Access Control
- 9:41Permissions vs scopes
- 13:23Scopes
- 14:20Slides
- 14:40Q A
related talks
31mAuthorised is Not a Yes No Question
34mFine-Grained Permissions in K8s: What’s Missing, and How to Fix That
21mAuthorised is Not a Yes/No Question
24mExpanding beyond authentication with emerging authorization standards
47mFine Grained Authorisation with Relationship Based Access Control
25mModernizing Authorization: From Basic Roles to Decoupled ABAC
27mI Can RBAC, and So Can You!
41mFine Grained Authorisation with Relationship-Based Access Control