Notifications
Clear all
Topic starter
10/06/2026 11:25 pm
TL;DR: Utility operators dealing with SCADA, contractors, auditors, and third-party vendors face growing friction when authorization is spread across roles, embedded app rules, and databases, according to Cerbos. The core issue is that static RBAC makes policy updates, onboarding, audit evidence, and contextual access harder to manage at enterprise scale.
NHIMG editorial — based on content published by Cerbos: policy-based authorization for utility environments
By the numbers:
- Utility Warehouse, a FTSE 250 multiservice energy provider, replaced a cumbersome in-house authorization system spanning 4,500 services with Cerbos.
Questions worth separating out
Q: How should utility companies centralize authorization without breaking operations?
A: Utility companies should centralize authorization in a policy layer that can be updated independently of application releases.
Q: Why do RBAC models become brittle in operational technology environments?
A: RBAC becomes brittle when access depends on context such as location, time, asset state, or temporary escalation.
Q: How do teams know if policy-based authorization is actually improving governance?
A: Teams should look for shorter change windows, fewer manual exceptions, clearer audit trails, and less dependency on developers for routine access updates.
Practitioner guidance
- Map authorization logic out of application code Inventory where role checks, embedded rules, and database permissions are currently enforced.
- Model contextual access conditions explicitly Identify which decisions depend on time, location, asset state, user type, or temporary operational escalation.
- Test policy changes before production rollout Use sample data and staged evaluation to verify that new authorization rules behave correctly for engineers, contractors, vendors, and auditors before they reach live systems.
What's in the full article
Cerbos' full engineering guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how the RBAC and ABAC policies are written for SCADA and gas flow sensor access
- Change-management workflow details for rolling policy updates without downtime in production
- Policy migration guidance for onboarding a new application into a centralized authorization framework
- Audit and compliance examples showing how authorization logs are prepared for ISO27001 certification
👉 Read Cerbos' engineering guide on policy-based authorization for utility environments →
RBAC vs policy-based authorization in utilities: what changes?
Explore further
12/06/2026 5:22 am
Policy sprawl is the real authorization risk in utility environments: When access logic is split across databases, embedded rules, and application-specific code, governance becomes fragmented even before a breach or audit issue appears. The article shows that the operational cost is not abstract. Every change requires coordination across systems, which increases the chance of stale permissions and inconsistent enforcement. Practitioners should treat fragmented policy ownership as an access-control failure mode, not just an engineering inconvenience.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, while inadequate monitoring and logging and over-privileged accounts each account for 37%.
A question worth separating out:
Q: What is the difference between embedded authorization rules and centralized policy management?
A: Embedded rules live inside application code or local databases, so each system becomes its own control point. Centralized policy management separates the decision logic from the application, making it easier to maintain, test, and audit. For regulated environments, that separation is what turns authorization into a governable lifecycle process instead of a hidden implementation detail.
👉 Read our full editorial: Policy-based authorization for utilities: RBAC tradeoffs at scale
