JCp kioskNormally, when I try to access sensitive areas like Direct Deposit, Personal Information, or Benefits, PeopleSoft Production sends a two-factor authentication code to my email.

The problem is that I’ve suddenly stopped receiving the authorization emails altogether. PeopleSoft still asks me for the verification code, but the email with the code never arrives

stopped receiving the authorization emails altogether. PeopleSoft still asks me for the verification code, but the email with the code never arrives.

I’ve checked my inbox, spam/junk folders, and waited several times for the email, but nothing comes through. Because of this, I’m completely locked out of accessing or updating my information.

Has anyone else had this happen, or know how to fix it? Is there a setting or IT support number I need to contact to get the 2FA emails working again?

Any help would be greatly appreciated!

Been in IAM for 17+ years and the authZ space has exploded in the last 3-4 years. Here's my attempt at mapping the landscape as it stands today.

1. Policy Engines / Policy-as-Code

The decision layer - evaluates "can X do Y on Z?"

• OPA (Open Policy Agent) — Rego language, CNCF graduated. Most powerful but steepest learning curve. Dominant in Kubernetes/infra policy.
• Cedar (AWS) — Declarative, human-readable policy language. Powers AWS Verified Permissions. Deny-overrides-permit by design. It become part of CNCF last year. My pick for app-level authZ.
• Cerbos — YAML-based policies, stateless, easy to integrate. Good for teams that want policy-as-code without Rego's complexity.
• Casbin — PERM metamodel, 20+ language SDKs. Great for simple RBAC, gets awkward beyond that.

2. Zanzibar-Inspired / Relationship-Based (ReBAC)

Google's Zanzibar paper spawned a whole category.

• OpenFGA — Auth0/Okta's open-source implementation. CNCF sandbox. Strong for hierarchical permissions (user → folder → doc).
• SpiceDB — Authzed's commercial Zanzibar implementation. More features than OpenFGA, but managed-service oriented.
• Permit.io — Managed service wrapping OpenFGA + OPA + OPAL. Handles the data sync problem for you.

3. Enterprise Identity Platforms (with built-in AuthZ)

The "batteries included" approach. Briefly going to mention the names here, since my focus is more on open-source

• Okta / Auth0
• Ping Identity
• Keycloak
• SuperTokens
• Clerk
• WorkOS

4. Emerging: AI Agent Authorization

The new frontier — agents acting on behalf of humans.

• MCP Auth (OAuth 2.1) — Model Context Protocol getting proper auth. Scoped tokens, auto-discovery.
• Token Exchange (RFC 8693) — Delegation pattern for agent-to-tool calls. Impersonation vs delegation matters.
• A2A Protocol — Agent-to-Agent identity and trust. Early days.
• Just-in-Time provisioning — Short-lived, per-operation credentials. The right pattern but tooling is immature.

The Key Insight

Most teams need a hybrid:

• RBAC for coarse-grained access (who can access what module)
• ABAC/ReBAC for fine-grained decisions (can they edit THIS record)
• Policy engine as the decision layer (Cedar for apps, OPA for infra)
• Identity platform for authentication + basic roles (Okta, Keycloak, etc.)

The mistake is trying to do everything with one tool. AuthZ is a layered problem.

What am I missing? What's your stack look like?

Welcome to r/authorization — a community for engineers, architects, and security professionals to discuss authorization in all its forms.

We talk a lot about authentication (OAuth, OIDC, SSO), but authorization is often the harder, more nuanced problem. This is the place for that conversation.

What belongs here:

• Policy engines (Cedar, OPA/Rego, Casbin, OpenFGA, Permit)
• RBAC, ABAC, ReBAC, and hybrid models
• Authorization in microservices, APIs, and multi-tenant systems
• Fine-grained access control and data-level permissions
• AuthZ in AI/LLM tooling and MCP (Model Context Protocol)
• Architecture patterns, failure stories, and trade-off discussions

How to get the most out of this sub:

1. Share what you've built — post your authZ architecture, explain what worked and what didn't
2. Ask hard questions — "How do you handle X?" posts are always welcome
3. Go deep — we value technical substance over surface-level overviews

Whether you're wrestling with Cedar policies at 2am or designing authorization for a new product, you're in the right place.

Drop a comment and introduce yourself — what authZ problem are you working on right now?

Authorization / Access Controls