authorizer

An authorizer is a software component responsible for making authorization decisions. It determines whether a given operation or request should be allowed, based on the identity of the requester and applicable policies. Typically, authentication occurs first to verify identity; the authorizer then evaluates whether the authenticated subject has permission.

Authorizers are common in API security, microservices architectures, cloud platforms, and enterprise applications. In API gateways and serverless environments, an authorizer intercepts incoming requests, checks credentials or tokens, and returns an allow/deny result or a policy that governs access to resources. If allowed, the request proceeds; if denied, a suitable error is returned.

Types of authorizers include: policy-based authorization, which uses role-based (RBAC) or attribute-based (ABAC) policies to decide access; token-based authorization, where tokens such as JSON Web Tokens carry claims that an authorizer uses to grant permissions; and external authorization services, where the decision is delegated to an external system via APIs. OAuth 2.0 and OpenID Connect frameworks use authorization servers that issue access tokens consumed by resource servers, whose own authorizers validate tokens and scope.

Implementations may rely on signature verification, token introspection, LDAP/Directory services, or predefined access control lists. Performance considerations include caching decisions and the trade-off between centralized policy management and latency.

See also: access control, RBAC, ABAC, PBAC, OAuth, JWT, OpenID Connect.