{"product_id":"authorization-in-action-9781633435179","title":"Authorization in Action","description":"\u003cp\u003e\u003cb\u003eGet the eBook free when you register your print book at Manning.\u003c\/b\u003e\u003cbr\u003e\u003cbr\u003e\u003cb\u003e\"Covers every aspect of building dynamic authorization systems. No AI architect should be without it.”\u003cbr\u003e —Drummond Reed, Co-author of Self-Sovereign Identity\u003c\/b\u003e\u003cbr\u003e \u003cbr\u003eUnderlying all software security is access control: deciding who can get into a system and what they can do once they enter. This book shows you how to streamline and automate access control by replacing static manually assigned permissions with a dynamic, Policy-Based Access Control (PBAC) model. Author and identity expert \u003cb\u003ePhillip Windley\u003c\/b\u003e frames authorization as a first-class citizen in your architecture and shows you how to use the intuitive Cedar policy language to integrate modern access control efficiently into both new and legacy applications.\u003cbr\u003e \u003cbr\u003eRather than relying on abstract theory, this practical guide uses the journey of a fictional corporation to demonstrate how policy-based access models succeed at scales where static models inevitably fail. You will watch the corporate systems transition from basic Access Control Lists (ACLs) to sophisticated, multi-tenant SaaS environments that include zero trust architectures, secure APIs, verifiable credentials, and AI agents. This single, continuous case study is grounded in famous real-world security collapses, such as the infamous Target data breach that illustrates the catastrophic consequences of weak authorization boundaries.\u003cbr\u003e \u003cbr\u003eAt the core of the book is the Cedar policy language, which makes it much easier to unify Role-Based (RBAC), Attribute-Based (ABAC), and Relationship-Based (ReBAC) access control into PBAC. The book describes typed schemas and how to write policies that are safe by construction, eliminating the common security risks of hard-coded runtime conditionals. As reviewer \u003cb\u003eMichael Schleichardt\u003c\/b\u003e of eHealth Experts GmbH points out, “By decoupling authorization logic from application code, you gain the ability to reduce operational overhead and adapt seamlessly to shifting regulatory compliance.”\u003cbr\u003e \u003cbr\u003eWindley tackles cutting-edge security, including decentralized identity and AI. You’ll explore how to integrate cryptographically signed verifiable credentials using a “Trust Diamond” framework. Crucially, the book addresses agentic AI systems, introducing patterns like authorization before retrieval for Retrieval-Augmented Generation (RAG). Professor \u003cb\u003eYang Luo\u003c\/b\u003e of Peking University notes, “This book provides excellent integration of real-world context, which makes dynamic decisions actually dynamic,” and ensures that LLMs operate strictly on authorized data.\u003cbr\u003e \u003cbr\u003eSpanning 19 comprehensive chapters, \u003ci\u003eAuthorization in Action\u003c\/i\u003e provides a complete roadmap from foundational access concepts to enterprise-level policy governance. The hands-on learning experience is deeply enhanced by practical appendices, including an end-to-end tutorial using Amazon Verified Permissions and live, executable agent demonstrations using the OpenClaw runtime. When you’ve finished, you’ll have mastered a battle-tested toolkit of reusable patterns ready to secure access dynamically to your APIs, microservices, and distributed cloud systems.\u003cbr\u003e \u003cbr\u003e \u003cb\u003eWhat's inside\u003c\/b\u003e\u003cbr\u003e \u003cbr\u003e • Unify RBAC, ABAC, and ReBAC into a single PBAC framework\u003cbr\u003e • Write secure, statically validated policies using the Cedar language\u003cbr\u003e • Implement robust zero trust security controls across distributed microservices\u003cbr\u003e • Authorize autonomous AI agents and protect sensitive RAG workflows\u003cbr\u003e \u003cbr\u003e\u003cb\u003eAbout the reader\u003c\/b\u003e\u003cbr\u003e \u003cbr\u003e For IT professionals, software architects, security engineers, and product managers who want to build secure, scalable systems.\u003cbr\u003e \u003cbr\u003e \u003cb\u003eAbout the author\u003c\/b\u003e\u003cbr\u003e \u003cbr\u003e \u003cb\u003ePhillip J. Windley\u003c\/b\u003e is the co-founder of the Internet Identity Workshop and was a Senior Software Development Manager at AWS Identity. His deep enterprise experience in cloud-native identity systems makes him a premier authority on modern, policy-based access control architectures.\u003cbr\u003e \u003cbr\u003e \u003cb\u003eTable of Contents\u003c\/b\u003e\u003cbr\u003e \u003cbr\u003e 1 Why authorization matters: Securing access in a digital world\u003cbr\u003e 2 Understanding digital identity\u003cbr\u003e 3 Authentication: Who are you?\u003cbr\u003e 4 Authorization: What can you do?\u003cbr\u003e 5 Static authorization models\u003cbr\u003e 6 Dynamic authorization models\u003cbr\u003e 7 The building blocks of policy\u003cbr\u003e 8 Policy languages and frameworks\u003cbr\u003e 9 Implementing policies with Cedar\u003cbr\u003e 10 Policy as code: Effective authorization policies\u003cbr\u003e 11 Authorization for APIs\u003cbr\u003e 12 Authorization context\u003cbr\u003e 13 Using policy engines with existing systems\u003cbr\u003e 14 Policy governance\u003cbr\u003e 15 Security, zero trust, and authorization\u003cbr\u003e 16 Using verifiable credentials for authorization\u003cbr\u003e 17 AI in policy practice\u003cbr\u003e 18 Authorization for AI agents\u003cbr\u003e 19 Authorization as strategy\u003c\/p\u003e","brand":"Phil Windley","offers":[{"title":"Default Title","offer_id":56469998731606,"sku":"9781633435179","price":66.09,"currency_code":"EUR","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0886\/3206\/6390\/files\/9781633435179.jpg?v=1793784812","url":"https:\/\/www.bookshop.lt\/ru\/products\/authorization-in-action-9781633435179","provider":"Bookshop","version":"1.0","type":"link"}