AuthZEN
AuthZEN is an OpenID Foundation working group developing interoperability standards for authorization. Its Authorization API 1.0 specification defines a common interface through which enforcement components can request access decisions from authorization engines.
- Synonym
- OpenID AuthZENAuthorization API
Definition
AuthZEN is a standardization initiative focused on communication between authorization components. The Authorization API 1.0, approved as an OpenID Final Specification on January 12, 2026, defines how a Policy Enforcement Point (PEP) can request an authorization decision from a Policy Decision Point (PDP).
An access evaluation request contains a Subject, an Action, and a Resource, with an optional Context. The PDP evaluates the request according to its authorization policies and returns a decision indicating whether the requested action is permitted or denied.
AuthZEN does not define the underlying business policies or require a specific authorization engine. It standardizes communication between components, while policy design, contextual information, and effective enforcement remain responsibilities of the overall architecture.
Why it matters
Applications and authorization engines often exchange access requests and decisions through vendor-specific interfaces. These differences can complicate integrations and create unnecessary dependencies between application developers and authorization technology providers.
AuthZEN introduces a common communication contract between these components. It supports interoperability without guaranteeing that authorization policies are correct, contextual information is trustworthy, or decisions are properly enforced.
The Ariovis perspective
OAuth and AuthZEN address complementary requirements. OAuth supports delegated access and token-based interactions, while AuthZEN provides an interface for requesting authorization decisions about specific actions on specific resources.
This distinction is particularly relevant to APIs and AI agents, whose technical permissions may exceed the actions they should perform. AuthZEN standardizes the interaction between enforcement and decision components, but effective security still depends on policy quality and enforcement that cannot be bypassed.
Related services
Common pitfalls
- AuthZEN is not a PBAC engine, a universal policy language, or an OAuth replacement. Supporting a standardized authorization interface does not automatically mean that applications enforce appropriately granular business permissions.
- The final Authorization API 1.0 specification must also be distinguished from other AuthZEN working group deliverables. Additional work concerning obligations, approval requests, and MCP integrations may belong to separate specifications that are still under development.
Resources
Go further
Explore this category
These concepts matter most inside a real project.
The first conversation helps establish your context, the systems involved and the next useful decision.