PlainID Policy Manager

Digital transformation increases exposure of “crown jewels,” yet many breaches stem less from sophisticated attacks than from weak, inconsistent authorization. While authentication has advanced from passwords to biometrics, MFA, and risk-based methods, authorization frequently remains fragmented: handled per application, owned by IT teams rather than management, and misaligned with business processes. As infrastructures become hybrid and heterogeneous (on‑prem, cloud, SaaS, mobile), the absence of shared security models forces organizations to define policies repeatedly, usually falling back on coarse-grained RBAC. Even when enterprise security policies exist in business language, translating them into technical controls is difficult, despite standards like XACML and OAuth 2.0.

PlainID, a privately held authorization vendor founded in 2014 and headquartered in Tel Aviv, addresses this gap with Policy-Based Access Control (PBAC), unifying static roles with dynamic attributes of users, devices, and resources to enable real-time, fine-grained decisions. The platform centralizes business-oriented policy design in a graphical console, hiding technical complexity while supporting workflows, approvals, segregation of duties, sandboxes for testing, and version control. A server component (“Rule Engine”) combines GUI, lifecycle management, runtime decisioning, and integration interfaces, storing authorization artifacts in an embedded graph database and supporting clustering and separate test/stage deployments.

PlainID integrates with standards (XACML, OAuth 2.0, token formats) and third-party systems (IAM/IGA, database proxies, Hadoop, SaaS). Recognizing legacy constraints, it expanded in 2019 to cover coarse to fine-grained authorization in one platform, adding Role & Entitlement Manager (lifecycle management plus analytics, mining, forensics) and Partner Manager for B2B delegated administration with global policies and auditing. Strengths include unified authorization coverage and business-friendly tooling; challenges include no built-in enforcement and prior niche positioning.

• Many data breaches occur because of weak and inconsistent access management rather than highly sophisticated cyberattacks.
• Authentication has evolved from passwords to biometrics, multi-factor authentication, and risk-based solutions.
• Authorization is often implemented inconsistently across organizations and is frequently treated as an IT or per-application responsibility.
• Enterprise IT environments are increasingly distributed across on-prem, cloud, SaaS, and mobile deployments.
• Standardization efforts cited include XACML and OAuth 2.0, yet most applications do not share or integrate security models.
• PlainID is a privately held vendor headquartered in Tel Aviv, Israel and was founded in 2014.
• PlainID’s platform includes a server software component called “Rule Engine.”
• Authorization artifacts are stored in an embedded graph database, and multiple server instances can be clustered for performance or high availability.
• In 2019, PlainID expanded to support coarse-, medium-, and fine-grained authorization within a single PBAC platform.
• The platform’s stated challenge includes having no built-in enforcement capabilities and relying on third-party tools such as database proxies.

• “Access control decisions are an integral part (perhaps one of the biggest even) of every organization’s daily business processes.”
• “In the end, every decision to give or to deny user access to a resource is a part of a business process and thus a decision for company management, not IT.”
• “PlainID has named this approach Policy-Based Access Control (PBAC), which allows both static roles assigned to a user and dynamic attributes (of both the user, their device and of the resource itself) to be taken into account when making access decisions.”
• “But the key advantage of PBAC is that a high-level business-oriented policy only needs to be designed once, and the rest is taken care of by the platform automatically.”
• “As opposed to competitors in this market, PlainID places the strongest emphasis on graphical policy design and workflow management tools that allow non-technical people to create policies independently from IT, test and validate them and then deploy them into production environments.”
• “Notably, all these questions translate to completely different authorization paradigms and may require different enforcement controls to actually implement.”
• “All authorization artifacts (entitlements, roles, and policies themselves) are stored in an embedded graph database.”
• “Most would prefer to maintain their legacy infrastructures or apps at least through a transitional period.”
• “Another upcoming addition to the platform is Partner Manager, which is a solution aimed at B2B interaction scenarios.”
• “Perhaps the biggest obstacle for wider adoption of policy-based access control, however, is that it requires companies to rethink and modernize their existing IAM architectures.”