Authorised is Not a Yes No Question
summary
Compares attribute-based access control and role-based access control and recommends starting with RBAC for simplicity then layering ABAC for fine-grained rules as needed. Builds a small shopping app using Flask + React demo and uses Auth0 and JWT permissions to enforce create/delete scopes; creates permissions "create_items" and "delete_items", makes roles editor/admin, assigns editor only create, and shows token’s permissions array enables the app to allow POSTs but block DELETEs. Demonstration works after enabling RBAC permissions in the API.
AI-written summary · about
chapters (9)
- 0:00Start
- 6:16assign a clearance level to a subject or a person
- 11:40implement access control
- 20:18assign to some permissions
- 21:04assign a role
- 23:48add the permissions into the access token
- 26:17automate this process of assigning roles
- 28:41add new rules
- 29:05create an empty rule
related talks
21mAuthorised is Not a Yes/No Question
27mAuthorised is not a Yes/No question
23mThat's out of scope!
47mFine Grained Authorisation with Relationship Based Access Control
41mFine Grained Authorisation with Relationship-Based Access Control
26mGetting Permission or Asking Forgiveness?
36mFlexible Authorisation with ASP.NET Core 7.0
27mAccess management in 4D