The model from this series has humans and businesses as principals, but not agents, and no way to represent a delegation that's been requested but not yet approved. Both turned out to need real additions, not workarounds.
Toby Allen
Solutions Engineer at Okta. I write about identity, access management, and security. This site archives my published articles, talks, and presentations.
Series - Indepth Explainers
Latest
Delegation you can put a number on
· Auth0, Customer Identity Products, Auth0 FGA
Every delegation in this series so far has been bounded by time. This post covers the other kind: bounded by a dollar figure, or a dollar figure and a category together, checked fresh against every attempted spend rather than a stored running total.
Verified directors and public registries: identity proofing meets FGA
· Auth0, Customer Identity Products, Auth0 FGA
A company registry needs three things a subscription service doesn't: a public entry anyone can search, a governance role distinct from day-to-day admin, and proof that whoever holds that role is who they say they are.
Building Embedded Passkey Login with Auth0
· Auth0, Customer Identity Products, passkey
Auth0's Passkey APIs let you build passkey sign-in directly into your own UI instead of redirecting to Universal Login. Here's how that fits alongside Universal Login, what self-service passkey management looks like hand-rolled versus with Auth0's official pre-built components, and one Allowed Origins (CORS) setting worth checking before you go looking for a WebAuthn bug that isn't there.
One authorisation model, a dozen industries
· Auth0, Customer Identity Products, Auth0 FGA
It's easy to claim an authorisation model is generic. It's more convincing to run the exact same model, unmodified, across media, healthcare, financial services, telco, retail and legal case management, and show the tests passing every time.
Auth0 Anonymous Sessions: Cookies and Metadata Are Both Fixed at Creation
· Auth0, Customer Identity Products, Identity Security
An anonymous session's cookie and its metadata are both set once, at the moment the session is created, and neither one changes again for the rest of that session's life. That single fact reshapes how you have to track state across the handoff into a known identity.