Dynamic Authorization Management

Dynamic Authorization Management (DAM) is positioned as a key segment within Access Management that improves access control by externalizing authorization decisions to a policy-based server that evaluates requests at run time. Traditional approaches—often relying on locally managed role-based entitlements such as Active Directory group membership—make it difficult to apply consistent, enterprise-wide policy and to adapt quickly to change. DAM replaces hard-coded, application-specific logic with centrally administered policies that can be reused across many applications and resources, enabling rapid policy updates without reassigning entitlements in identity stores.

A core advantage is real-time evaluation against current attributes: when identity or contextual attributes change, the resulting access decisions change immediately rather than waiting for batch synchronization. DAM also supports risk-aware access decisions, such as requiring higher authentication assurance (step-up authentication) when access occurs outside business hours. Desired solution characteristics include externalized decisioning, attribute-based evaluation (including user, resource, and context attributes), and policy-driven consistency across environments.

The market is driven by the need for common policy deployment, the need to support diverse authorization requirements (from broad entitlements to fine-grained controls), and increasing demand for real-time decisions. A DAM architecture typically includes Policy Decision Points (PDP), Policy Administration Points (PAP), Policy Repositories/Retrieval Points (PRP), Policy Enforcement Points (PEP), and Policy Information Points (PIP), often leveraging standards such as XACML (with noted implementation variability) or architectures like NGAC.

Market direction ties DAM to an emerging “Identity Fabric” supporting cloud migration, containerized/microservices deployments, ubiquitous MFA/adaptive authentication, network monitoring, behavioral analytics, and AI. The market is considered established with mature deployments, but adoption is still largely constrained to larger enterprises with the resources to implement DAM at scale.

• Dynamic Authorization Management focuses on access control via run-time evaluation of policies using an external authorization server.
• Role-based entitlements are commonly implemented through Microsoft Active Directory groups that are typically managed locally.
• In dynamic authorization environments, policies are evaluated in real time against current attributes, so decisions can change immediately when attributes change.
• A DAM decision can return “permit,” “deny,” or “indeterminant.”
• XACML is described as the most widespread authorization protocol, and XACML deployments can differ so plug-and-play cannot be assumed.
• The market is described as past the hype stage, with trusted solutions and many mature deployments.
• DAM adoption is constrained and is most often considered by larger enterprises with the resources to deploy such solutions.
• Vendors covered in the report include Atos, Axiomatics, EmpowerID, Jericho Systems, NextLabs, PlainID, Symphonic Software, and WSO2.
• AWS and Auth0 are identified as “vendors to watch” even though they are not considered complete DAM solution providers in this report.
• NextLabs offers CloudAz as an “Authorization-as-a-Service” managed service delivering NextLabs functionality.

• “DAM is part of the Access Management market sector and focused on access control via run-time evaluation of policies.”
• “These solutions externalize access control decisions to a policy-based authorization server.”
• “One reason for pursuing a dynamic authorization environment is the ability to establish consistent access control policy across an organization.”
• “As soon as an attribute changes, policy decisions based on that attribute will change, rather than having to wait for a nightly update of identity attributes before access control policy is correctly applied.”
• “A dynamic authorization environment also facilitates the application of risk management to access control decisions.”
• “It is no longer necessary for access control logic to be coded into each application.”
• “Rather than relying on the more widespread role-based access control a dynamic authorization service will evaluate a user’s attributes, but also resource attributes, in real time.”
• “With a central policy store the same policy can be used for multiple protected resources.”
• “Support is now required for on-premise applications, SaaS apps and multiple cloud environments.”
• “The hype associated with dynamic authorization management is clearly over with trusted solutions and many mature deployments that demonstrate the improved efficiency and better security associated with an access control environment that centralizes policy administration and streamlines authorization processes.”