Authorization in Action MEAP V06 Build policy-based access control for Zero Trust, APIs, SaaS, and AI agents (Phil Windley)（Z-Library）

【One-Line Pitch】 A practical guide to replacing stale, static permissions with policy-based, real-time authorization that adapts to context, relationships, and business change. Best for identity architects, developers, product managers, and IT leaders who already know authentication basics and want to design and govern dynamic access control. 【Book Arc】 - **Opening (~0%–13%)**: Frames authorization as architecture, not a security checkbox, using the 2013 Target breach to show how weak access boundaries and poor visibility turn a minor compromise into catastrophe. - **Early (~13%–33%)**: Builds the conceptual foundation—digital identity as relationship management, the proximity problem, authentication vs. authorization, and why policy-based access control (PBAC) externalizes decision logic from application code. - **Middle (~33%–58%)**: Diagnoses the limits of static models (Unix permissions, ACLs, RBAC) across scalability, flexibility, maintainability, efficiency, auditability, Zero Trust, and consistency—showing where role proliferation and over-permissioning originate. - **Late (~58% onward)**: Moves toward dynamic authorization that merges role-, attribute-, and relationship-based models, with policy design, decision-logic integration, and governance structures (excerpts do not cover later chapters in detail). - **Ending (beyond excerpt coverage)**: Promises emerging challenges such as access control for AI agents and a full design-implement-govern arc across nineteen chapters, but the excerpts do not cover these final stages. 【Key Takeaways】 - **Authorization is architecture, not a checklist** (Early): Treating access control as a first-class design concern enables product features and security simultaneously, rather than bolting it on later. - **Digital identity exists to manage relationships** (Early): Systems must recognize, remember, and relate to entities—people, services, things, or AI agents—making identity foundational to both security and usability. - **Static authorization fails at scale** (Middle): ACLs, groups, and roles become unwieldy as principals, resources, and context multiply, forcing manual updates and workarounds. - **Context is the hard problem static lists cannot solve** (Middle): Time, location, device status, on-call status, and just-in-time elevation require runtime evaluation, not precomputed permissions. - **Role proliferation obscures accountability** (Middle): Special-purpose roles like "Contractor-Editor" accumulate, making it difficult to predict or audit who can access what. - **PBAC externalizes decision logic** (Early): Moving policy out of application code yields flexible, fine-grained, auditable decisions that are easier to author, maintain, and enforce consistently. - **Governance gaps create compliance risk** (Middle): Without a central policy view, business leaders cannot verify that their intent—such as GDPR data residency—is actually enforced. - **Zero Trust is impractical with static tools alone** (Middle): Retrofitting every system is expensive, so organizations settle for partial controls unless they adopt dynamic authorization. 【Reading Tips】 - Deep-read the early chapters on identity, relationships, and PBAC—they establish the vocabulary the rest of the book depends on. - Skim the static-authorization limitation sections if you already know RBAC/ACL pain points, but note the concrete failure scenarios (Target, EHR, multi-national retail) as ammunition for stakeholder buy-in. - Pay close attention to the ACME Corp case study threaded through the book; it converts abstract models into design decisions. - Treat governance and team-structure material as equally important as policy syntax—sustainable authorization depends on organizational alignment, not just engines. - Since this is a MEAP edition, expect later chapters on AI agents and advanced implementation to be less settled; verify against the final release. 【Coverage Limits】 This guide is based on stratified excerpts covering roughly the first 58% of the book, primarily the opening, foundational, and static-authorization critique chapters. Later implementation, governance, and AI-agent material is referenced but not detailed in the excerpts.