Building Modern Authorization: A Practical Guide To Centralized, Distributed, and...
Talkat Open Source Summit Japan + AI_dev: Open Source GenAI & ML Summit + Automotive Linux Summit 2025 · 2025-12-08..12-10·
summary
Three live stacks (centralized, distributed, hybrid) get built and demoed: an echo API behind EngineX/Envoy as PEP, OPA or embedded PDPs, Keycloak as PIP/IDP, policies in Git and pushed by OPAL. Measured P99 latency is ~100 ms for fully centralized vs ~10 ms for local PDPs; hybrid is fast for local checks but can spike to ~100 ms when it fetches central attributes. Centralized shows immediate consistency, distributed is eventually consistent (minutes delay), and hybrid fails some requests during a central outage when additional data is required. All demo artifacts are on GitHub.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:06Authorization basics
- 2:33Why auth feels harder
- 3:58Modern auth patterns
- 8:14Centralized auth deep dive
- 9:16Distributed auth deep dive
- 9:56Hybrid auth deep dive
- 11:04Tools for auth patterns
- 12:33Architecture examples
- 16:13Architecture decision playbook
- 18:04Case studies
- 21:06Live demo setup
- 21:54Demo architecture
- 24:27Distributed policy files
- 25:55Hybrid policy files
- 27:02Demo latency measurement
- 28:53Demo consistency testing
- 34:22Demo availability testing
- 36:52Key takeaways
- 38:39Q&A
related talks
51mPermissions: Centralized or Decentralized? Both!
55mAuthEN: Standards for modern authorization
42mExploring Best Practice for Implementing Authn and Authz in a Cloud-Native...
45mThe Future of Authorization in Applications
20mIt passed auth, then production caught fire.
43mApplication Code of Conduct - Full-Stack Policy as Code
30mIAM on Hybrid Cloud: Next Generation Security Model to Create an Interoperable Cloud [I]
54mAuthorization for modern Applications