Topic starter
10/06/2026 11:17 pm
TL;DR: Externalized authorization can cover legacy applications without code changes by placing a gateway in front of them, centralising policy in Cerbos Synapse, and combining OAuth2/OIDC authentication with route-level and context-aware decisions, according to Cerbos. The hard problem is not policy design but extending governance to systems that cannot be rewritten, where audit gaps and inconsistent controls still dominate.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “How to add authorization to legacy applications without code changes”.
Key questions
Q: How should teams govern legacy applications that cannot be modified?
A: Use a gateway or reverse proxy to enforce externalized authorization before the application receives the request.
Q: Why do legacy apps create authorization risk even when modern services are covered?
A: Because partial coverage fragments the control model.
Q: What breaks when route-level authorization is the only control available?
A: Fine-grained data filtering still remains outside the gateway, so teams cannot treat route control as a full replacement for application-level authorization.
Practitioner guidance
- Establish gateway enforcement first Place a reverse proxy in front of unmodifiable applications and make it the authorization enforcement point before any application request is allowed through.
- Start with route-level policy coverage Map legacy URLs and HTTP methods to allow and deny rules so that obvious administrative and sensitive paths are governed consistently across the estate.
- Add contextual signals to access decisions Feed device posture, user risk, location, and HR status into policy evaluation so legacy access reflects the conditions of the request, not just the role claim.
Bottom line: Legacy applications are not exempt from modern identity governance just because they cannot be modified.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 5:11 am
Fragmented authorization is the real legacy risk, not lack of policy sophistication. The governance failure in old estates is usually uneven enforcement, not the absence of a clever policy model. When only modern services are covered by centralized controls, the systems most likely to hold sensitive data remain outside the same decision boundary. The practitioner conclusion is to judge authorization coverage by estate consistency, not by the elegance of the policy language.
A question worth separating out:
Q: What should security teams do when a legacy app still needs its own login?
A: Separate authentication from authorization and document both layers. The gateway can establish the trusted identity for policy decisions while the application keeps its own login for local access, if required. That split is common in older systems, and governance should treat it as an interim control model rather than a clean SSO design.
👉 Read our full editorial: Externalized authorization for legacy apps needs gateway enforcement
This post was modified 5 days ago by NHI Mgmt Group