As advisors, we at KuppingerCole Analysts have regular discussions with our customers around authorization. For a long time, these discussions were relatively stable. Role-Based Access Control (RBAC) was the established approach, widely implemented and generally accepted. This has changed significantly in recent years. Dynamic Authorization is now clearly identified as a trend and latest discussions around EIC25 confirm this. However, the interesting part is not the trend itself, but the reasons behind it.
Authorization Was Stable, Until the Environment Changed
For decades, authorization was mainly implemented using RBAC. The idea is simple: Define roles, map permissions to roles, and assign users to roles. This worked well in structured and relatively static IT environments. However, IT environments have changed.
The move to the cloud, the growing popularity of Software as a Service and the shift towards Zero Trust (and much more) have fundamentally altered access requirements. Identity has become the central control point, and with that, access scenarios have become more diverse and more complex. At the same time, scalability and distributed administration became more important. RBAC, while still valuable, started to struggle under these conditions.
Over time, a clear pattern emerged. RBAC is not sufficiently able to resolve many modern access use cases. Organizations typically faced two outcomes. Either access approaches remained incomplete, increasing risk, or they tried to cover all scenarios by creating more and more roles, leading to role explosion and significantly increased administrative effort. In practice, this meant choosing between increased risk or increased effort. Neither option is desirable.
ABAC: Flexibility Through Attributes
To address these challenges, more flexible models were required. Attribute-Based Access Control (ABAC) became the logical next step. ABAC focuses much more on flexibility by using attributes attached to the identity, the object, or parts of the overall context. Another advantage of ABAC is that it enables fine-grained access decisions by incorporating multiple criteria. Based on these rules, access is granted or denied.
Over the last decade, different ABAC-based approaches with slightly different focuses have emerged, resulting in a variety of control models such as ReBAC, NGAC, and others. While the naming differs, the core idea remains the same: capturing context to make better access decisions. A more detailed overview can be found in the research “A Taxonomy of Modern Authorization Models” by Alex Babeanu and Tariq Shaikh.
From Static to Dynamic: Why Timing Matters
One aspect that is often underestimated is the timing of access decisions. In the past, authorization was mainly prepared at administration time and executed at runtime. A user was added to a group, and during access, this group membership was checked. This is a typical example of coarse-grained access control: one criterion, defined upfront, evaluated during login, no continuous check. Today, this is no longer sufficient. Access decisions are becoming more dynamic, and the timing of these decisions becomes more important.
At KuppingerCole Analysts, we differentiate four stages:
- Admin-Time (Before Access)
Admin-time defines the foundation of authorization before any user interaction takes place. It includes identity lifecycle processes such as onboarding, provisioning, role assignment, and policy definition. It determines who should have access under normal conditions. However, these decisions are static and cannot reflect changing context, behavior, or risk during actual system usage. - Real-Time | Session Initialization (At Login / Access Request)
At the moment of access, authentication and initial authorization decisions are executed. Policies are evaluated using context such as identity attributes, device, or location. This remains the traditional control point: a decision is made at entry, typically as a one-time evaluation assuming conditions remain stable. - Real-Time | Session Management (During Active Use)
During an active session, authorization moves beyond a single decision. Access is continuously evaluated and adjusted based on changing context, behavior, or risk signals. This enables adaptive controls such as modifying permissions or terminating sessions when anomalies occur, turning authorization into an ongoing process rather than a one-time check. - Post-Event Time (After Access and Interaction)
After access has occurred, the focus shifts to retrospective analysis through auditing, reporting, and access analytics. Activities across all stages are evaluated to detect issues, ensure compliance, and identify improvements. While not influencing decisions in real time, these insights are essential for refining policies and strengthening future authorization decisions.
This differentiation highlights a fundamental shift. Traditional models focus mainly on admin-time activities and coarse-grained decisions, often evaluated once at the moment of access. Modern approaches increasingly rely on real-time evaluation and fine-grained control, but this does not stop at session initialization. Initial checks at the perimeter are no longer sufficient. Instead, authorization must extend into session management.
Fine-Grained and Real-Time: A Necessary Evolution
Access decisions are continuously monitored and actively enforced throughout an active session. Context can change, behavior can deviate, and risks can emerge after access has already been granted. This requires continuous and adaptive controls to detect and prevent malicious behavior, session takeover, or unintended data exposure. Authorization is no longer a single decision, but an ongoing process.
With the number and complexity of use cases increasing, this shift is not optional. Modern access control models focus much more on fine-grained decisions, based on multiple attributes, and real-time evaluation across different stages of access. This is especially relevant with the rise of Non-Human Identities (NHIs), where automated interactions require fast, scalable, and context-aware authorization.
Organizations and vendors are already actively developing new models and solutions to address these challenges. Initiatives such as AuthZen are examples of how the industry is preparing for future authorization requirements.
Dynamic Authorization: A Trend Driven by Necessity
Dynamic Authorization is clearly a trend, but not because it is new or fashionable. It is a direct response to changing environments and increasing complexity. RBAC remains relevant, but it is no longer sufficient on its own. The future of authorization lies in combining different models, incorporating context, and making decisions continuously rather than once. Organizations that understand this shift can better balance flexibility, scalability, and security. Those who do not will continue to face the familiar trade-off between effort and risk.
Learn more about this topic at EIC in Berlin. See you there in my session “Authorization Put to the Test: How Modern Authorization Models Actually Help“!
