AuthZEN: Finally a Standard for Authorization APIs

Authorization has always been one of those problems every team solves differently. Some hardcode it, some roll their own RBAC, some bolt on a policy engine. There’s never been a standard way for your app to ask “can this user do this?” and get an answer — until now.

AuthZEN is an OpenID Foundation spec that defines a clean API between Policy Enforcement Points (PEPs) and Policy Decision Points (PDPs). Your app asks the question; the authorization service answers it. Simple, vendor-neutral, and finally standardized.

The core model is elegant: a request contains a Subject (who), Resource (what), Action (the operation), and optional Context (environment). The response is a decision — allow or deny — with optional reasons or obligations attached.

I’m currently building an authorization layer based on ReBAC (Relationship-Based Access Control) using this spec as the API contract — I’ll be posting more about that soon.

If you’re building anything that touches authorization, read the spec. It’s worth it.