Spring authorization scattered in code: what changes with Cerbos?

TL;DR: Scattered role checks in Spring controllers and services become hard to maintain as authorization rules grow, and Cerbos’ annotation-driven approach externalises decisions into policy, according to Cerbos. Separating authentication from authorization makes access control easier to audit, change, and test without redeploying application code.

NHIMG editorial — based on content published by Cerbos: policy-driven authorization in Spring Security with Cerbos and AOP

Questions worth separating out

Q: How should teams avoid scattering authorization logic across Spring services?

A: Teams should move access rules out of controllers and into a policy engine, then trigger checks with annotations or interceptors.

Q: When does policy-driven authorization make more sense than hard-coded role checks?

A: It makes more sense when access depends on attributes, ownership, or changing business rules.

Q: What do security teams get wrong about separating authentication and authorization?

A: They often treat them as interchangeable, but authentication proves identity while authorization governs permitted actions.

Practitioner guidance

• Externalise authorization from controllers Move access rules out of endpoint code and into policy so updates do not require application redeploys.
• Standardise the principal-resource-action model Pass consistent attributes for the subject, the target resource, and the requested action so policy checks remain predictable across services.
• Use annotations only as decision triggers Keep annotations as the marker for where a check must happen, but make the policy engine own the actual allow or deny decision.

What's in the full article

Cerbos' full guide covers the implementation detail this post intentionally leaves for the source:

• Step-by-step Spring Boot and Spring Security project setup for the Cerbos integration.
• Full Java examples for the Cerbos client, helper service, and AOP aspect wiring.
• Complete policy YAML for resource rules and derived roles that enforce ownership conditions.
• Local development setup with Docker Compose and Cerbos configuration files.

👉 Read Cerbos' guide to policy-driven authorization in Spring Security →

Spring authorization scattered in code: what changes with Cerbos?

Explore further

View Full Forum →  |  NHI Foundation Course →