We recently wrote a technical post on Why Authorization is Hard, and the discussion that followed was universally: yeah, this is hard. So we're here to share more about this problem.

Authorization is one of the most commonly implemented layers in an app – it controls who can do what (with permissions, roles, etc.) Recently engineering teams at Google, Airbnb, Carta, Slack, and Intuit have written about the major efforts they undertook to build out custom authorization systems. And now the pace of engineering in this area is accelerating.

This is a technical talk where members of the Oso engineering team will share the challenges of building a generic authorization system for startups like Sesh and Fiddler to bigger companies like Intercom, Wayfair and Visa. Andrew McClain, founding engineer from Sesh, will also talk about his experience as a developer solving for authorization.

*Sam (cofounder/CTO, Oso) will explain the technical tradeoffs of the domain and how different companies have approached them — e.g., Why did Google choose to build a distributed relationship tuple store? And why is Oso building an embedded framework in Rust instead?
*GK (engineer, Oso) will give a design review of Resource Blocks – i.e., how we captured the majority of authorization models in a handful of patterns.
*Andrew (founding engineer, Sesh) will talk about how he implemented authorization in Go, why he needed Oso to work with pointer methods, and how authorization has been fun for the first time in 20 years.

At the end, we'll have Q&A, casual discussion, and limited edition swag 🐻. See you there.