August 2026
Intermediate
464 pages
15h 9m
English
Overview
"Covers every aspect of building dynamic authorization systems. No AI architect should be without it.”
—Drummond Reed, Co-author of Self-Sovereign Identity
Underlying all software security is access control: deciding who can get into a system and what they can do once they enter. Authorization in Action shows you how to streamline and automate access control by replacing static manually assigned permissions with a dynamic, Policy-Based Access Control (PBAC) model. Author and identity expert Phillip Windley frames authorization as a first-class citizen in your architecture and shows you how to use the intuitive Cedar policy language to integrate modern access control efficiently into both new and legacy applications.
Rather than relying on abstract theory, this practical guide uses the journey of a fictional corporation to demonstrate how policy-based access models succeed at scales where static models inevitably fail. You will watch the corporate systems transition from basic Access Control Lists (ACLs) to sophisticated, multi-tenant SaaS environments that include zero trust architectures, secure APIs, verifiable credentials, and AI agents. This single, continuous case study is grounded in famous real-world security collapses, such as the infamous Target data breach that illustrates the catastrophic consequences of weak authorization boundaries.
At the core of the book is the Cedar policy language, which makes it much easier to unify Role-Based (RBAC), Attribute-Based (ABAC), and Relationship-Based (ReBAC) access control into PBAC. The book describes typed schemas and how to write policies that are safe by construction, eliminating the common security risks of hard-coded runtime conditionals. As reviewer Michael Schleichardt of eHealth Experts GmbH points out, “By decoupling authorization logic from application code, you gain the ability to reduce operational overhead and adapt seamlessly to shifting regulatory compliance.”
Windley tackles cutting-edge security, including decentralized identity and AI. You’ll explore how to integrate cryptographically signed verifiable credentials using a “Trust Diamond” framework. Crucially, the book addresses agentic AI systems, introducing patterns like authorization before retrieval for Retrieval-Augmented Generation (RAG). Professor Yang Luo of Peking University notes, “This book provides excellent integration of real-world context, which makes dynamic decisions actually dynamic,” and ensures that LLMs operate strictly on authorized data.
Spanning 19 comprehensive chapters, Authorization in Action provides a complete roadmap from foundational access concepts to enterprise-level policy governance. The hands-on learning experience is deeply enhanced by practical appendices, including an end-to-end tutorial using Amazon Verified Permissions and live, executable agent demonstrations using the OpenClaw runtime. When you’ve finished, you’ll have mastered a battle-tested toolkit of reusable patterns ready to secure access dynamically to your APIs, microservices, and distributed cloud systems.
About the Technology
About the Book
What's Inside
About the Reader
For IT professionals, software architects, security engineers, and product managers who want to build secure, scalable systems.
About the Author
Phillip J. Windley is the co-founder of the Internet Identity Workshop and was a Senior Software Development Manager at AWS Identity. His deep enterprise experience in cloud-native identity systems makes him a premier authority on modern, policy-based access control architectures.
Quotes
A comprehensive guide on the critical area of authorization.
- Atul Tulshibagwale, CrowdStrike
Authorization is an old problem, but this book makes a solid case for revisiting it with fresh eyes.
- Chris Simmons, AWS Identity
Crisp, comprehensive, and practical—the guide practitioners need.
- Eve Maler, Author of Mastering Digital Identity
A tour de force on authorization, covering its history, evolution, relationship to other IAM systems as well as implementation recommendations.
- Gerry Gebel, Former co-chair of OpenID Foundation AuthZEN Working Group
A timely and useful book for anyone trying to build authorization that can keep pace with increasingly complex and autonomous systems.
- Heather Flanagan, Spherical Cow Consulting
Access control and authorization have never been more important than they are today. This book is a great reference to get started.
- Josh Bressers, Host of the Open Source Security Podcast
—Drummond Reed, Co-author of Self-Sovereign Identity
Underlying all software security is access control: deciding who can get into a system and what they can do once they enter. Authorization in Action shows you how to streamline and automate access control by replacing static manually assigned permissions with a dynamic, Policy-Based Access Control (PBAC) model. Author and identity expert Phillip Windley frames authorization as a first-class citizen in your architecture and shows you how to use the intuitive Cedar policy language to integrate modern access control efficiently into both new and legacy applications.
Rather than relying on abstract theory, this practical guide uses the journey of a fictional corporation to demonstrate how policy-based access models succeed at scales where static models inevitably fail. You will watch the corporate systems transition from basic Access Control Lists (ACLs) to sophisticated, multi-tenant SaaS environments that include zero trust architectures, secure APIs, verifiable credentials, and AI agents. This single, continuous case study is grounded in famous real-world security collapses, such as the infamous Target data breach that illustrates the catastrophic consequences of weak authorization boundaries.
At the core of the book is the Cedar policy language, which makes it much easier to unify Role-Based (RBAC), Attribute-Based (ABAC), and Relationship-Based (ReBAC) access control into PBAC. The book describes typed schemas and how to write policies that are safe by construction, eliminating the common security risks of hard-coded runtime conditionals. As reviewer Michael Schleichardt of eHealth Experts GmbH points out, “By decoupling authorization logic from application code, you gain the ability to reduce operational overhead and adapt seamlessly to shifting regulatory compliance.”
Windley tackles cutting-edge security, including decentralized identity and AI. You’ll explore how to integrate cryptographically signed verifiable credentials using a “Trust Diamond” framework. Crucially, the book addresses agentic AI systems, introducing patterns like authorization before retrieval for Retrieval-Augmented Generation (RAG). Professor Yang Luo of Peking University notes, “This book provides excellent integration of real-world context, which makes dynamic decisions actually dynamic,” and ensures that LLMs operate strictly on authorized data.
Spanning 19 comprehensive chapters, Authorization in Action provides a complete roadmap from foundational access concepts to enterprise-level policy governance. The hands-on learning experience is deeply enhanced by practical appendices, including an end-to-end tutorial using Amazon Verified Permissions and live, executable agent demonstrations using the OpenClaw runtime. When you’ve finished, you’ll have mastered a battle-tested toolkit of reusable patterns ready to secure access dynamically to your APIs, microservices, and distributed cloud systems.
About the Technology
About the Book
What's Inside
- Unify RBAC, ABAC, and ReBAC into a single PBAC framework
- Write secure, statically validated policies using the Cedar language
- Implement robust zero trust security controls across distributed microservices
- Authorize autonomous AI agents and protect sensitive RAG workflows
About the Reader
For IT professionals, software architects, security engineers, and product managers who want to build secure, scalable systems.
About the Author
Phillip J. Windley is the co-founder of the Internet Identity Workshop and was a Senior Software Development Manager at AWS Identity. His deep enterprise experience in cloud-native identity systems makes him a premier authority on modern, policy-based access control architectures.
Quotes
A comprehensive guide on the critical area of authorization.
- Atul Tulshibagwale, CrowdStrike
Authorization is an old problem, but this book makes a solid case for revisiting it with fresh eyes.
- Chris Simmons, AWS Identity
Crisp, comprehensive, and practical—the guide practitioners need.
- Eve Maler, Author of Mastering Digital Identity
A tour de force on authorization, covering its history, evolution, relationship to other IAM systems as well as implementation recommendations.
- Gerry Gebel, Former co-chair of OpenID Foundation AuthZEN Working Group
A timely and useful book for anyone trying to build authorization that can keep pace with increasingly complex and autonomous systems.
- Heather Flanagan, Spherical Cow Consulting
Access control and authorization have never been more important than they are today. This book is a great reference to get started.
- Josh Bressers, Host of the Open Source Security Podcast
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.