Externalized Authorization
Architecture pattern where authorization logic is moved from application code to a dedicated service (PDP). Your app asks for decisions rather than embedding permission checks.
Externalized authorization is an architecture pattern where authorization logic is moved from application code to a dedicated, centralized service — the Policy Decision Point (PDP). Instead of embedding permission checks in every handler, your application asks a single question: "is this allowed?"
The embedded authorization anti-pattern
// BAD: Business rules hard-coded, duplicated, invisible
if (user.role !== 'admin' && user.role !== 'manager') throw new Forbidden()The externalized pattern
// GOOD: One line, same everywhere, rules live in the PDP
await requirePermission(user.id, scopeId, 'invoice', 'delete')Benefits
- One source of truth — rules in the PDP, not scattered across services
- Auditability — policy changes are data changes, logged and reviewable
- Velocity — changing who can do what no longer requires a code deploy
- Consistency — every service enforces the same decision
Related terms
Authorization that evaluates permissions at the individual resource or action level, rather than broadly by user type or role.
The authorization engine that evaluates access requests against policies and returns allow/deny decisions. The PDP is the "brain" — it owns the rules and logic.
Thin code in your application that intercepts requests and asks the PDP "is this allowed?" The PEP enforces decisions but does not own policy logic.