Thread by @Auth0Lab

1/ On Wed, we posted about why we are doing this and what we expect.

https://twitter.com/Auth0Lab/status/1321470724893192195?s=20

We also promised to unveil this week the problem we want to dive into 🥁...

2/ The area we'd like to explore is: *fine-grained authorization*

Why this? And why now?👇

3/ Large scale fine-grained authorization as a building block is an unsolved problem. Just like authentication was ~8 years ago. We implement it in every app we build, over and over. There is no generic, cross-platform, cross-domain solution.

4/ It is hard to generalize because it is tightly coupled to our app logic.

We all typically start with a simple implementation: coarse roles (admin/reader), stored in the same DB your product uses. Sounds familiar? 😅

5/ 😫 The pain:
If you are successful, requirements start coming in:
- Decouple permissions and roles
- Add support for groups/organizations
- Support workspaces/tenants
- Granular permissions and policies

6/ We already support role-based and attribute-based access control today, and there is more coming on our roadmap.

But we believe there is an opportunity to solve this beyond simple RBAC or ABAC, and we are in an excellent position to do it.

7/ We will dive into understanding the requirements of large products that require fine-grained ACL checks and policy-based authorization decisions.

8/ Our ASK: If you have experience implementing authorization, good or bad 😛, we'd love to chat. DM us or join our Discord discord.gg/pvbNmqC.