Authorization in Action

"Covers every aspect of building dynamic authorization systems. No AI architect should be without it.”

—Drummond Reed, Co-author of Self-Sovereign Identity

Underlying all software security is access control: deciding who can get into a system and what they can do once they enter. Authorization in Action shows you how to streamline and automate access control by replacing static manually assigned permissions with a dynamic, Policy-Based Access Control (PBAC) model. Author and identity expert Phillip Windley frames authorization as a first-class citizen in your architecture and shows you how to use the intuitive Cedar policy language to integrate modern access control efficiently into both new and legacy applications.

Rather than relying on abstract theory, this practical guide uses the journey of a fictional corporation to demonstrate how policy-based access models succeed at scales where static models inevitably fail. You will watch the corporate systems transition from basic Access Control Lists (ACLs) to sophisticated, multi-tenant SaaS environments that include zero trust architectures, secure APIs, verifiable credentials, and AI agents. This single, continuous case study is grounded in famous real-world security collapses, such as the infamous Target data breach that illustrates the catastrophic consequences of weak authorization boundaries.

At the core of the book is the Cedar policy language, which makes it much easier to unify Role-Based (RBAC), Attribute-Based (ABAC), and Relationship-Based (ReBAC) access control into PBAC. The book describes typed schemas and how to write policies that are safe by construction, eliminating the common security risks of hard-coded runtime conditionals. As reviewer Michael Schleichardt of eHealth Experts GmbH points out, “By decoupling authorization logic from application code, you gain the ability to reduce operational overhead and adapt seamlessly to shifting regulatory compliance.”

Windley tackles cutting-edge security, including decentralized identity and AI. You’ll explore how to integrate cryptographically signed verifiable credentials using a “Trust Diamond” framework. Crucially, the book addresses agentic AI systems, introducing patterns like authorization before retrieval for Retrieval-Augmented Generation (RAG). Professor Yang Luo of Peking University notes, “This book provides excellent integration of real-world context, which makes dynamic decisions actually dynamic,” and ensures that LLMs operate strictly on authorized data.

Spanning 19 comprehensive chapters, Authorization in Action provides a complete roadmap from foundational access concepts to enterprise-level policy governance. The hands-on learning experience is deeply enhanced by practical appendices, including an end-to-end tutorial using Amazon Verified Permissions and live, executable agent demonstrations using the OpenClaw runtime. When you’ve finished, you’ll have mastered a battle-tested toolkit of reusable patterns ready to secure access dynamically to your APIs, microservices, and distributed cloud systems.

what's inside

• Unify RBAC, ABAC, and ReBAC into a single PBAC framework
• Write secure, statically validated policies using the Cedar language
• Implement robust zero trust security controls across distributed microservices
• Authorize autonomous AI agents and protect sensitive RAG workflows

About the reader

For IT professionals, software architects, security engineers, and product managers who want to build secure, scalable systems.

About the author

Phillip J. Windley is the co-founder of the Internet Identity Workshop and was a Senior Software Development Manager at AWS Identity. His deep enterprise experience in cloud-native identity systems makes him a premier authority on modern, policy-based access control architectures.

Ebook License

End-User Warranty And License Agreement

1. Grant Of License

Manning Has Authorized The Download By You Of An Unrestricted Number Of Copies Of The Electronic Book (Ebook) In Any Of The Available Formats. Manning Grants You A Nonexclusive, Nontransferable License To Use The Ebook According To The Terms And Conditions Herein. This License Agreement Permits You To Install The Ebook On Any And All Your Devices For Your Personal Use Only.

2. Restrictions

You Shall Not: (1) Share, Resell, Rent, Assign, Timeshare, Distribute, Or Transfer All Or Part Of The Ebook Or Any Rights Granted Hereunder To Any Other Person; (2) Duplicate The Ebook, Except For A Single Backup Or Archival Copy; (3) Remove Any Proprietary Notices, Labels, Or Marks From The Ebook; (4) Transfer Or Sublicense Title To The Ebook To Any Other Party.

3. Intellectual Property Protection

The Ebook Is Owned By Manning And Is Protected By United States And International Copyright And Other Intellectual Property Laws. Manning Reserves All Rights In The Ebook Not Expressly Granted Herein. This License And Your Right To Use The Ebook Terminate Automatically If You Violate Any Part Of This Agreement. In The Event Of Termination, You Must Remove The Original And Any Copies Of The Ebook From All Your Devices.

4. Source Code Supplementary Material

Any Source Code Files Provided As A Supplement To The Book Are Freely Available To The Public For Download. Reuse Of The Code Is Permitted, In Whole Or In Part, Including The Creation Of Derivative Works, Provided That You Acknowledge That You Are Using It And Identify The Source: Title, Publisher And Year.

5. Limited Warranty

Manning Warrants That The Ebook Files, A Copy Of Which You Are Authorized To Download, Are Free From Defects In The Operational Sense That They Can Be Read By A Pdf Reader Or Epub Reader, Or Other. Except For This Express Limited Warranty, Manning Makes And You Receive No Warranties, Express, Implied, Statutory Or In Any Communication With You, And Manning Specifically Disclaims Any Other Warranty Including The Implied Warranty Of Merchantability Or Fitness Or A Particular Purpose. Manning Does Not Warrant That The Operation Of The Ebook Will Be Uninterrupted Or Error Free. If The Ebook Was Purchased In The United States, The Above Exclusions May Not Apply To You As Some States Do Not Allow The Exclusion Of Implied Warranties. In Addition To The Above Warranty Rights, You May Also Have Other Rights That Vary From State To State.

6. Limitation Of Liability

In No Event Will Manning Be Liable For Any Damages, Whether Arising For Tort Or Contract, Including Loss Of Data, Lost Profits, Or Other Special, Incidental, Consequential, Or Indirect Damages Arising Out Of The Use Or Inability To Use The Ebook.

7. General

This Agreement Constitutes The Entire Agreement Between You And Manning And Supersedes Any Prior Agreement Concerning The Ebook. This Agreement Is Governed By The Laws Of The State Of New York.