Authorization isn’t just a checkbox in the security compliance list—it’s a fundamental security control that shapes how software behaves in production. Yet most of us have wrestled with authz systems that either trap us in vendor ecosystems or leave us maintaining a tangled mess of if-statements that make us question our life choices. But there’s hope! From the CNCF to the OpenID Foundation, the open source community is doing some really neat stuff with authz right now. In this talk, we’ll explore how modern authz patterns are embedding security principles as a core part of the software development lifecycle—so we can catch access control vulnerabilities during dev rather than in prod, and build more secure, maintainable systems. We’ll cover practical patterns for implementing robust access control logic, strategies for testing authorization rules as part of your security testing suite, and techniques for making authorization an integral part of your development process from day one.
