Authorization models Study Portal

TL;DR

Authentication says who you are; authorization says what you may do, and the design choices come down to two questions: where is the check made (inside the token, at a gateway, in a central policy service, in each service) and how quickly can access be taken away (at token expiry, within seconds, or immediately). Self-contained tokens are fast and hard to revoke; reference tokens are revocable and cost a lookup; policy and relationship engines centralise the rules at the price of a network call. Twelve designs follow, each with one plain-words line, where the check lives, revoke latency, pros, cons, who uses it, and sources. The combination section pairs them with the tenancy models from the Multi-tenancy module.