Notifications
Clear all
Topic starter
23/06/2026 7:29 pm
TL;DR: Authorization is framed as a maturity problem for zero trust and AI-powered systems, with contextual and continuous decisions across apps, APIs, AI agents, MCP servers, services, and workloads, according to Cerbos. That shifts attention from static permission design to decision-time context, which is where modern identity control now breaks down.
NHIMG editorial — based on content published by Cerbos: Cerbos second anniversary
Questions worth separating out
Q: How should teams centralize authorization across apps and APIs?
A: Teams should move authorization logic into a shared policy decision point and keep enforcement close to the application or service.
Q: Why does contextual authorization matter for AI agents and workloads?
A: Contextual authorization matters because AI agents and workloads often need task-specific access that changes with the request, not with the identity record alone.
Q: What breaks when authorization is left inside application code?
A: When authorization stays inside application code, teams lose centralized visibility into policy changes, exceptions, and inconsistent enforcement.
Practitioner guidance
- Map authorization decisions to a control plane Inventory where access checks live today and identify services that still embed bespoke authorization logic.
- Add runtime context to policy evaluation Ensure authorization decisions receive identity, resource, and relationship data before every request is evaluated.
- Review AI agent access as a dynamic authorization problem Treat agent access as conditional and task-scoped, not as a one-time role assignment.
What's in the full article
Cerbos' full announcement covers the product architecture and implementation detail this post intentionally leaves for the source:
- How the open-source Policy Decision Point, Enforcement Point integrations, and Cerbos Hub fit together in practice
- How Cerbos Synapse gathers identity, resource, and relationship data before each authorization decision
- How the vendor describes continuous authorization across applications, APIs, AI agents, MCP servers, services, and workloads
- How its positioning maps to externalized authorization and Zero Trust environments
👉 Read Cerbos' announcement on authorization maturity for zero trust and AI-powered systems →
Authorization maturity for AI-powered systems: what changes now?
Explore further
25/06/2026 3:31 am
Authorization maturity is now a control-plane issue, not an application feature. When authorization logic remains embedded in individual services, identity governance loses line of sight into how access is actually decided. Externalized policy evaluation creates the auditability and consistency that mature IAM and NHI programmes need. The practitioner takeaway is that authorization should be treated as shared infrastructure, not optional application code.
A few things that frame the scale:
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to The 2024 Non-Human Identity Security Report.
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts.
A question worth separating out:
Q: How do teams know whether authorization maturity is improving?
A: They should look for fewer application-specific exceptions, more consistent allow and deny outcomes, and stronger evidence that policies are enforced the same way across environments. Mature programmes can explain each access decision, show who changed the policy, and demonstrate that runtime context is part of the decision.
👉 Read our full editorial: Authorization maturity in zero trust and AI-powered systems
