IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
The big picture
Authentication answered one question: who. This track answered the bigger one: what. Here is the whole story before the quiz.
The story you just lived
Priya proved she was Priya at the door. Then the real work began. First you learned three ways to decide what she may do: a role, a rule or a relationship (see RBAC, ABAC and ReBAC). You learned to model permissions as a graph, so Sam can view a file he was never given directly.
Rules were hiding in scattered if lines, so you moved them into policy as code. You designed the permission menu with scopes and consent. Maya read a greedy consent screen and tapped Deny. You compared a static key with a short-lived token.
Then you put every request through one guarded door, the API gateway. Last, you toured how it all breaks. Maya changed one digit in a URL and read Sam's booking. Nobody asked "is 1002 hers?" One missing check is how a breach starts.
Separate deciding from enforcing
The part that decides is not the part that enforces. Policy as code splits the PDP from the PEP. The gateway asks and obeys. Change a rule in one place, and every door follows.
Every check asks which tenant
In a shared product, every check also asks: whose data is this? The tenant comes from the verified token (see tenant isolation).
Least privilege by design
Use narrow scopes and honest consent and credentials that expire on their own. Then least privilege is the easy default, not a cleanup you keep postponing.
The missing check is the breach
Most API breaches are a check that nobody wrote. A missing object-level check is BOLA (see the OWASP tour). Never assume that authentication also means authorization.
This is the half of identity that actually gets breached. Pick the right model, move the rule out of the code, scope the grant, enforce it at the door, and ask the object-level question. Then you can read a pen-test report and know which lesson each finding comes from.
The five everyday pictures, again
- An office ID card is a role (RBAC).
- A shared Google Drive folder is a relationship (the graph).
- A bank locker with two keys is a rule (policy as code).
- A WhatsApp group admin has power only inside one group (tenants).
- A railway reservation chart checks one seat (BOLA).
Where these ideas go next
See fine-grained authorization for agents, identity across microservices and consent phishing.
Ready to test it? The cheat sheet and pop quiz is one page away.