Authorization

People often imagine software as a sequence of answers.

I remember it as a sequence of increasingly better questions.

KOVA did not begin with an authorization engine. It began with a vehicle, a phone number, and an uncomfortable realization that identity is not singular. A person owns a vehicle. The same person can belong to a business. That business owns assets. The same account may become a driver tomorrow, an administrator next month, and a customer forever.

Those are not different people.

They are different truths.

In the beginning I believed, like most engineers do, that someone else had already solved this problem. Authorization platforms existed. Policy engines existed. Standards existed. It seemed almost irresponsible to build something myself. Why reinvent the wheel when mature systems had already done the difficult work?

That is how Cerbos entered the story.

For a while it felt like the correct decision. Policies became YAML files instead of scattered conditionals. Permissions had names. Resources had types. Everything appeared cleaner than handwritten authorization logic.

Clean enough to make me believe the hard part was over.

It wasn't.

The further KOVA evolved, the less its world resembled the examples authorization systems are usually designed for.

Who is the resource?

The vehicle?

The tag attached to the vehicle?

The anonymous relay session?

The organization?

The driver's assignment?

The account?

The customer's subscription?

The entitlement?

The answer kept changing depending on where I stood.

Identity was no longer a single object.

Resources were no longer single objects either.

A business administrator could create vehicles without driving them.

A driver could operate assets without owning them.

A platform administrator existed outside customer organizations entirely.

An internal consultant might belong to several customers but must never accidentally see another customer's data.

One account could wear several identities simultaneously.

The policy engine wanted everything flattened into subjects, resources and actions.

Reality refused.

I still remember countless conversations where the same sentence kept returning in different forms.

"What exactly is the identity here?"

Every time we answered it, another endpoint broke the definition.

So we stopped answering.

Instead we started cataloguing.

Every API.

Every route.

Every permission.

Every relationship.

Every assumption hiding inside years of decisions.

What looked like authorization work slowly became anthropology.

We weren't writing policies anymore.

We were discovering the civilization KOVA had quietly become.

That was the beginning of KAS RC1.

Not because Cerbos was a bad system.

Because KOVA had stopped being a problem that another engine could describe.

The breakthrough wasn't replacing one authorization engine with another.

The breakthrough was realizing authorization could never be the foundation.

Identity had to come first.

For weeks the architecture revolved around a deceptively simple question.

Who is asking?

Not what permission they have.

Not what role they possess.

Who are they right now?

An account could be an individual.

The same account could represent a business.

The same account might temporarily act as an internal operator.

Sometimes it acted on itself.

Sometimes on behalf of an organization.

Sometimes on behalf of another human being.

Identity became contextual instead of static.

Only after identity settled into place did resources begin making sense.

Resources were no longer isolated database rows.

They existed inside relationships.

A vehicle belonged somewhere.

A driver was assigned, not merely linked.

Organizations had boundaries.

Subscriptions carried entitlements.

Permissions existed inside context.

Authorization stopped being a lookup.

It became a journey.

Every request walked the same path.

Resolve identity.

Resolve context.

Resolve permission.

Resolve scope.

Resolve entitlement.

Only then ask whether the action should happen.

The order mattered.

Changing even one step produced entirely different answers.

Somewhere during that reconstruction another realization emerged.

Not every rule belonged inside permissions.

Some rules described the nature of the system itself.

Those became invariants.

The Potato Rule.

The Own Salvation Rule.

Bootstrap role immutability.

These weren't permissions.

They were promises.

Promises that even future developers — including myself — should not casually violate.

That changed how I viewed software forever.

Features change.

Policies evolve.

Plans become subscriptions.

Roles appear and disappear.

But invariants should feel geological.

Ancient.

Slow to form.

Almost impossible to move.

The authorization engine slowly disappeared from everyday thinking.

That sounds strange after spending so many weeks building it.

But disappearing was the goal.

Good authorization should become invisible.

When someone opens KOVA and adds a vehicle, they shouldn't sense the questions the system quietly answered.

Who are you?

Which identity are you using?

Which organization are you acting inside?

Do you own this?

Were you assigned this?

Does your subscription allow it?

Does any invariant forbid it?

All of those conversations happen in silence.

That silence was the achievement.

Looking back now, I don't remember individual commits.

I remember uncertainty.

Entire evenings spent convinced the model was fundamentally wrong.

Diagrams that looked elegant until the next requirement demolished them.

Moments where another endpoint exposed an assumption I didn't know I had made.

And then, eventually, something remarkable happened.

New features became easier instead of harder.

Permissions stopped multiplying.

Routes stopped inventing their own rules.

Identity became something discovered rather than guessed.

The architecture finally began saying "yes" and "no" for reasons that made sense.

That was KAS RC1.

Not a replacement for Cerbos.

Not an authorization framework.

A change in philosophy.

The project taught me something I hadn't expected.

Identity isn't a column in a database.

It isn't a JWT claim.

It isn't even a user.

Identity is the answer to a question every system asks, whether consciously or not:

"Who exists in this moment?"

Everything else is downstream from that.

Perhaps that's why I no longer think of KAS as an authorization engine.

Authorization is merely the visible part.

KAS is really an attempt to describe reality before software begins making decisions.

For a long time I believed I was building authentication.

Then I thought I was building authorization.

Only later did I understand I had been building language.

A language precise enough that KOVA could finally explain itself.