Design patterns
Explore reusable approaches to access control, federation, and application integration.
10 articlesStart with the foundationsRBAC, ABAC, and relationships
Compare three ways to express access policy and understand how they can work together.
Access control models compared
DAC, MAC, ACLs, capabilities, RBAC, ABAC, ReBAC, PBAC, and NGAC — characteristics, advantages, drawbacks, use cases, and implementations.
Policy engines and policy as code
Separate authorization decisions from application code with decision points, enforcement points, and versioned policy.
Authorization in APIs and microservices
Enforce object-level and function-level access, propagate identity safely between services, and isolate tenants.
API gateway security policies
Authentication, authorization, traffic, and threat-protection policies at the API edge, with examples from common gateways.
Backend for frontend (BFF) for browser apps
Keep tokens out of the browser with a BFF, and compare it with token-mediating backends and browser-based OAuth clients.
Native and mobile apps
Apply RFC 8252 to iOS, Android, and desktop apps, store tokens safely, and decide when a mobile BFF helps.
Cookies, session tokens, and web sessions
Design web sessions with secure cookies, server-side or stateless session tokens, timeouts, and protection against fixation and CSRF.
Federation and provisioning
Separate the runtime trust relationship from the administrative account lifecycle.
Just-in-time access and zero standing privilege
Grant elevated access only when needed, for a limited time, and remove it automatically.