Merou: A Decentralized, Audited Authorization Service
summary
Merou is Dropbox's open-source authorization service that manages access across corporate network, production data centers, and AWS and claims to remove security as a bottleneck by delegating approvals to team owners. It stores user profiles, uses permission:argument grants, supports Python plugins for automated approvals, exposes a REST read API with a read-only DB for integrations, and enforces quarterly access review via audited flags so decentralized grants remain visible and reversible.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:41What is it
- 1:35Why did we build it
- 3:36Compliance
- 4:54Approval
- 5:45Limitations
- 7:06LDAP or Internet
- 7:35Blanket
- 9:31Live Demo
- 17:14Audit Log
- 17:56Audit Training
- 18:50APIs
- 19:51Recap
related talks
10mUser-centric API Access control using UMA
29mKeeping Agents in Check: Apollo MCP Authentication
25mModernizing Authorization: From Basic Roles to Decoupled ABAC
39mAuthentication & Authorization Architecture in the MEAN Stack
39mUnified permission management between API and client
40mHow Yelp Moved Security From the App to the Mesh with Envoy and OPA
34mDecentralized Access Control with Medusa
24mEnhancing Compliance and Safety with Argo CD Ephemeral Access