Authorisation

Deciding what an authenticated identity may do, with roles, attributes or relationship-based rules. Check it on the server for every request, never only in the user interface.

Where it shows up in real systems

  • Identity provider

    Handles passwords, MFA and social login, then issues short-lived tokens. Services that call it on every request inherit its latency and availability; validating signed JWTs locally avoids that dependency.

    In production: Auth0, Keycloak, Amazon Cognito, Microsoft Entra ID, Okta

See it break, then fix it

Build an architecture, send it a day of traffic and outages, and learn why it holds or fails. Free to start.

Open the learning path Open the sandbox