---
title: "Standardized authorization with AuthZEN"
description: "AuthZEN, the OpenID Foundation standard for a vendor-neutral API between policy enforcement points and policy decision points, and how Cerbos implements it."
canonical: "https://www.cerbos.dev/authzen"
source: "https://www.cerbos.dev/authzen"
---

# Standardized authorization with AuthZEN

AuthZEN defines a vendor neutral request/response API format between Policy Enforcement Points and Policy Decision Points. Cerbos is part of the working group making this standard a reality for enterprises.

## Why authorization needs a standard?

AuthZEN is a new standard from an OpenID Foundation working group that aims to make authorization interoperable across apps, APIs, and services.

It sets out how a policy enforcement point, such as an application or API gateway, communicates with a policy decision point, the external engine responsible for authorization decisions.

Cerbos is the part of the working group, helping to test, improve and promote AuthZEN.

- **Lack of interoperability** — Proprietary authorization solutions create vendor lock-in and make it difficult to integrate best-of-breed components.
- **Inconsistent policy enforcement** — Authorization logic is often embedded within apps, leading to fragmented and inconsistent access rules across the enterprise.
- **Difficult to audit** — Without centralized authorization, it is difficult to see access policies and decisions.
- **Development overhead** — Development teams keep rebuilding authorization, wasting time and resources.

## The pillars of AuthZen standard

- **Vendor interoperability** — Avoid vendor lock-in and use the best authorization components for your needs, thanks to a standardized API.
- **Improved security posture** — Enhance security and simplify compliance with a unified and auditable authorization framework.
- **Dynamic, fine-grained access** — Enable real-time, context-aware authorization decisions that go beyond static roles and permissions.

## How it works

AuthZEN defines a standard interface between Policy Enforcement Points and Policy Decision Points, enabling interoperability across different vendors and platforms.

## Supported by major providers

AuthZEN is being adopted by major PDP and gateway providers, ensuring a wide range of support and interoperability.

- **PDP providers**
- **Gateway providers**

## Powered by the community

- **Alex Olivier** — CPO and Co-Founder at Cerbos
- **Allan Foster** — Member Board Of Directors at IDPro
- **Sean O’Dell** — Staff Security Engineer at Disney
- **Gerry Gebel** — ex-VP Product and Standards at Strata Identity
- **David Brossard** — CTO at Axiomatics
- **Omri Gazitt** — Previously CEO at Aserto

## Further reading

- [AuthZEN: standards-based authorization for enterprises](https://www.cerbos.dev/blog/authzen-standards-based-authorization-for-enterprises)
- [OpenID AuthZEN is official, and Cerbos is ready](https://www.cerbos.dev/blog/openid-authzen-is-official-cerbos-is-ready)
- [OpenID documentation](https://openid.github.io/authzen/)
- [Building a scalable authorization system: a step-by-step blueprint](https://solutions.cerbos.dev/building-a-scalable-authorization-system)