Tailor Made: Dynamic Fine-Grained Authorization for API Traffic - Erica Hughberg & Andres Aguiar

This talk covers dynamic fine-grained authorization for API traffic, presented by Erica Hughberg from Tetrate and Andres Aguiar from Okta. The speakers explore how modern API access control can move beyond static authorization methods, such as API keys and tokens, and enhance security through real-time access decisions. They demonstrate the implementation of fine-grained authorization at the gateway level by integrating OpenFGA with Envoy Gateway in Kubernetes, enabling context-aware access decisions. The session includes live demonstrations of OpenFGA's Relationship-based Access Control (ReBAC) model, addressing common authorization challenges in multi-tenant SaaS environments, B2B API access, and data-dependent rules.