HACKING PROJECT · cloud · Advanced
Distributed Access Control
Design and validate a centralized-policy, distributed-enforcement authorization system delivering fine-grained, auditable, least-privilege access across a service mesh.
In microservices, multi-cloud, and cross-organizational systems, access-control decisions must be made consistently across dozens of services with no shared session, yet teams routinely scatter authorization logic into each service, causing policy drift, confused-deputy bugs, and broken object-level authorization. Centralized IAM struggles with fine-grained, relationship-based, and context-aware decisions at scale, while token misissuance or over-scoped claims silently grant excess privilege. The distributed nature makes it hard to answer "who can access what and why" at any moment.
**What you'll build**
Build a policy-as-code distributed authorization architecture that externalizes decisions to a Policy Decision Point (OPA/Rego or a Zanzibar-style relationship engine) with per-service enforcement points, short-lived scoped tokens, and workload identity (mTLS/SPIFFE). Add centralized policy testing, decision logging for audit, and a "reverse index" to answer access queries across the mesh, then red-team for BOLA/BFLA, token replay, and privilege escalation. Deliver a reference ABAC/ReBAC platform proving consistent, auditable, least-privilege access across distributed services.
**Objective** — Design and validate a centralized-policy, distributed-enforcement authorization system delivering fine-grained, auditable, least-privilege access across a service mesh.
**Expected outcome** — A working externalized-authorization platform (PDP + PEPs) with Rego/relationship policies, decision-audit logging, an authorization test suite, and a BOLA/BFLA attack report.
**Difficulty** — Advanced — requires distributed-systems reasoning, policy modeling, and application security together.
**Primary category** — IAM / Authorization; Secondary = AppSec, Cloud Security, Zero Trust Architecture
**Security domains** — Primary = DevSecOps; Secondary = Cloud Security, Blue Team, AppSec, GRC, Red Team
**Technical focus** — ABAC/RBAC/ReBAC, policy-as-code (OPA/Rego), Zanzibar/relationship-based access, externalized authorization (PDP/PEP), workload identity (SPIFFE/SPIRE), mTLS, token scoping (OAuth2/JWT), BOLA/BFLA prevention, decision auditing, zero-trust authorization
**Core technologies** — Languages: Go, Python, Rego; Frameworks/Libraries: Open Policy Agent, OpenFGA/SpiceDB (Zanzibar), Envoy/Istio ext_authz, OAuth2/OIDC libs; Security Tools: Burp Suite, Authz fuzzers, mitmproxy; Cloud/Infra: Kubernetes, Istio/Linkerd, SPIRE, Terraform; AI/Data: policy-mining/analysis; Databases: PostgreSQL, relationship-tuple store
**Where it's valued** — SaaS, fintech, cloud platforms, healthcare, enterprises with microservices, B2B multi-tenant products
**Careers it builds toward** — IAM/Authorization Engineer, Platform Security Engineer, Cloud Security Engineer, DevSecOps Engineer, Application Security Engineer, Zero Trust Architect
**Framework alignment**
• MITRE ATT&CK: Privilege Escalation (TA0004); Valid Accounts (T1078); Abuse Elevation Control Mechanism (T1548); Exploitation for Privilege Escalation (T1068); Steal Application Access Token (T1528)
• NIST CSF 2.0: Protect (primary), Identify, Detect; NIST 800-207 Zero Trust policy engine model
• OWASP: A01 Broken Access Control; API1 BOLA, API5 BFLA, API3 Broken Object Property Level Authorization
• CIS Controls v8: 6 (Access Control Management), 5 (Account Management), 8 (Audit Log Management)
**Innovation** — Improved Existing Solution — externalized authz is emerging enterprise practice; a Zanzibar-style ReBAC platform with cross-mesh access querying is a standout, near-product-grade portfolio piece. Scores: Innovation 7/10, Startup 8/10, Enterprise-Readiness 8/10, Patent = No.