Cloudentity Authorization Control Plane

IT environments have grown more complex as enterprises expose more digital services via APIs and must enforce appropriate, authorized access that meets regulatory expectations. Traditional authorization, often embedded in individual applications with local entitlement stores, makes it hard to manage and enforce consistent enterprise-wide policies. Dynamic contextual authorization addresses this by using richer context to enable fine-grained, centrally managed controls over protected resources, supporting needs such as GDPR-oriented data authorization and Open Banking/PSD2 scenarios where banks must securely expose APIs to third parties while reducing fraud risk.

Modern security requirements also extend to mobile apps, IoT, machine-to-machine communication, and edge gateways, alongside a shift toward microservices and containerized architectures. While microservices enable autonomous teams and diverse technology stacks, they can create inconsistent authorization implementations (for example, divergent interpretations of token scope values). As expectations rise, authorization solutions are expected to support automation, incorporate AI-driven analytics for risk and suspicious event detection, and offer more intuitive policy authoring than traditionally complex policy languages.

Cloudentity, a Seattle-based privately held IAM vendor, positions its cloud-native CIAM.next platform (introduced in 2017) around dynamic authorization and authorization-as-code for APIs, microservices, and traditional workloads. Its Authorization Control Plane (ACP) sits between identity providers and application security, using identity session tokens plus contextual patterns to refresh and augment session data across security services. A key component, the Identity Hub, normalizes inconsistent OpenID Connect profile attributes across IdPs (e.g., “email” vs. “email-address”) and can ingest large-scale third-party data sources. ACP automates API discovery through integrations with gateways and service mesh sidecars and uses an open-source PDP (Pyron) plus distributed authorizers to enforce policy. Cloudentity provides a near-natural-language policy engine built on OPA, drag-and-drop authoring, policy packs, real-time testing, and bundled BI/analytics, with flexible SaaS and on-premises deployment options.

• Authorization verifies a user’s entitlements to access a specific controlled resource
• Dynamic contextual authorization is presented as supporting fine-grained controls and GDPR-related authorization needs
• PSD2 and Open Banking use cases require banks to provide secure APIs for Third Party Providers and other banks
• Cloudentity is a privately held identity and access management company headquartered in Seattle, Washington
• Cloudentity introduced its CIAM.next platform in 2017
• The Authorization Control Plane includes a lightweight Virtual Directory Service called the Identity Hub
• Identity Hub can normalize OpenID Connect profile data where different IdPs use different attribute names
• Identity Hub can ingest third-party data sources using SQL, NoSQL, graph-based, gRPC, or REST-based services
• Cloudentity’s policy engine is built on top of Open Policy Agent (OPA)
• SDKs are generated via Swagger to support over 60 programming languages and variants

• “Authorization is the act of verifying a user’s entitlements that grant them access to a specific controlled resource.”
• “A properly deployed dynamic authorization service takes access control to the next level.”
• “Contextual Dynamic Authorization is driven by the answers to the Who, What, Where, Why, and When type of questions.”
• “When any future API endpoint comes online, ACP can discover and apply applicable policies to it.”
• “Business analysts can use a drag-and-drop UI mechanism to build policies.”
• “Over a hundred different out-of-the-box policies are available that are separated into policy packs (e.g., Open Banking policy pack).”
• “ACP creates authorization-as-code and pushes it out to the endpoints.”
• “Cloudentity microservices are entirely API driven, so 100% of the Cloudentity functionality is available via APIs and its UI.”
• “Modern authorization solutions should provide advanced capabilities.”
• “Forward-thinking organizations should seek modern and advanced authorization products that can keep up with the changes.”