Authorization Patterns

Overview

Authorization patterns define how systems decide what authenticated users and services are allowed to do.

Common Patterns

• RBAC: role-based access decisions
• ABAC: attribute-based dynamic policies
• ReBAC: relationship-based access decisions

flowchart TD
    A[Authenticated Principal] --> B[Authorization Layer]
    B --> C{Pattern}
    C --> D[RBAC]
    C --> E[ABAC]
    C --> F[ReBAC]

Practical Example

A collaboration platform may use RBAC for admin capabilities and ReBAC for document sharing permissions between users.

Production Example

Enterprises often combine patterns: coarse RBAC for platform roles and ABAC policies for sensitive data access by region and classification.

Common Pitfalls

• Using one pattern for all use cases without trade-off analysis
• Missing policy review and approval process
• No test coverage for authorization rules

Key Takeaways

• Different authorization problems need different patterns.
• Hybrid models are common in production systems.
• Policy testing and auditing are essential.