Authn vs authz: where access control is getting harder

TL;DR: Authentication verifies identity while authorization determines allowed actions, and Authzed argues that modern systems need to keep those layers separate as permissions grow more dynamic and relationship-driven. For IAM teams, the real shift is that static role checks and token-based shortcuts no longer hold up under scale or revocation pressure.

NHIMG editorial — based on content published by Authzed: AuthN versus AuthZ, a primer on secure access

Questions worth separating out

Q: How should security teams separate authentication from authorization in modern applications?

A: Security teams should treat authentication as the step that proves identity and authorization as the step that evaluates permitted actions on specific resources.

Q: Why does relationship-based access control matter for application and NHI governance?

A: Relationship-based access control matters because many permissions are not really role-based at all.

Q: What breaks when authorization decisions are cached too long?

A: When authorization state is cached too long, a service can keep allowing access after a policy change or revocation should have taken effect.

Practitioner guidance

• Separate identity proof from permission enforcement Keep authentication in the identity provider layer and authorization in a dedicated decision point.
• Model access as resource relationships Map which subjects can act on which objects and why, then express those relationships explicitly instead of expanding roles until they become unmanageable.
• Test revocation and policy change propagation Verify that a removed entitlement stops working immediately enough for your risk tolerance.

What's in the full article

Authzed's full article covers the implementation detail this post intentionally leaves for the source:

• A deeper walkthrough of relationship-based access control schema design for application permissions
• Concrete examples of how OIDC subject claims flow into authorization checks at runtime
• Practical comparisons between RBAC, ABAC, and ReBAC for teams building fine-grained access control

👉 Read Authzed's primer on authentication versus authorization →

Authn vs authz: where access control is getting harder?

Explore further

View Full Forum →  |  NHI Foundation Course →