Policy-Based Authorization

Policy-Based Authorization

Policy-based authorization externalizes authorization logic from application code into declarative policies. This separation enables dynamic authorization changes without code modifications and provides a centralized view of security policies. Policy languages like XACML or Open Policy Agent's Rego enable complex authorization logic expression.

// JavaScript example using Open Policy Agent (OPA) style policies
const rego = `
package api.authz

default allow = false

# Allow users to read their own data
allow {
    input.method == "GET"
    input.path == ["users", input.user.id]
}

# Allow admins to read any user data
allow {
    input.method == "GET"
    input.path[0] == "users"
    input.user.roles[_] == "admin"
}

# Allow users to update their own profile
allow {
    input.method == "PUT"
    input.path == ["users", input.user.id, "profile"]
}

# Time-based access for sensitive operations
allow {
    input.method == "POST"
    input.path[0] == "reports"
    input.user.roles[_] == "analyst"
    time.hour(time.now_ns()) >= 9
    time.hour(time.now_ns()) <= 17
}
`;

// Policy evaluation
async function authorizeRequest(method, path, user) {
    const input = { method, path, user };
    const result = await evaluatePolicy(rego, input);
    return result.allow;
}

// Middleware implementation
async function authorizationMiddleware(req, res, next) {
    const allowed = await authorizeRequest(
        req.method,
        req.path.split('/').filter(Boolean),
        req.user
    );
    
    if (!allowed) {
        return res.status(403).json({ error: 'Forbidden' });
    }
    
    next();
}

Policy engines provide powerful features for complex authorization scenarios. They support policy versioning, enabling gradual rollouts and quick rollbacks. Policy simulation allows testing authorization changes before deployment. Audit logging of policy decisions provides compliance evidence and helps debug authorization issues.