Authorization perimeters

You can use authorization perimeters to control applications, workflows, services access data, and APIs on behalf of users. Auth perimeters provide a secure, scalable, and flexible approach to managing application access, ensuring that systems act only within clearly defined limits while maintaining full control and visibility for administrators.

Auth perimeters specify exactly what actions an application can perform, instead of relying on broad permissions or shared service accounts. Traditional approaches can be difficult to manage, hard to audit, and imprecise. They also rely on:

  • Shared service accounts
  • Static credentials
  • Broad permission scopes

Auth perimeters introduce a more secure and flexible model that:

  • Provides fine-grained access control.
  • Eliminates shared credentials.
  • Ensures access is validated dynamically at runtime.

These are the benefits of using auth perimeters:

  • Administrators can:
    • See all authorization perimeters in a centralized list.
    • See associated applications and user access levels.
    • Manage pre-authorized users for each perimeter.
    • Revoke access when needed.
  • End users can (where applicable):
    • See which applications have access.
    • Revoke perimeter access through the user settings interface.

These are the business benefits of using auth perimeters:

  • Stronger security: Limits access to only what is explicitly allowed.
  • Better compliance: Clear visibility and control over who can access what.
  • Operational simplicity: No need to manage service accounts or credentials.
  • Future-ready: Designed to support workflows, integrations, and AI-driven automation.

How does it work?

Each application or workflow defines one or more authorization perimeters. A perimeter represents a specific set of actions or access permissions. Administrators assign users to specific perimeters. This determines what actions the application can perform on behalf of those users. When an application or workflow runs these actions are performed:

  • It requests access using the user’s identity and the perimeter.
  • The system validates authorization in real time.
  • A short-lived token is issued only if access is allowed.

The application performs only the actions permitted by the perimeter. Access is tightly controlled and automatically limited.

These are the key capabilities that auth perimeters provide:

  • Fine-grained access control:
    • Defines access at more precise level than traditional permission scopes.
    • Restricts which APIs or actions can be executed.
  • Elimination of service accounts:
    • Removes the need to manage shared credentials.
    • Simplifies deployment and reduces security risks.
  • Real-time authorization:
    • Access is validated every time it is requested.
    • Ensures that permissions are always up to date.
  • Improved security for APIs:
    • Authorization perimeters can be enforced at the API level.
    • Prevents unintended or unauthorized API calls.
  • Safe enablement for AI and automation:
    • Each workflow or AI agent can be restricted to a defined set of actions.
    • Helps prevent unintended behavior or overreach.
  • Simplified deployment across environments:
    • Perimeters can be bundled with applications and workflows.
    • Enables consistent migration across environments, such as dev, test, or production.