SECAI Core · phase 10 of 15 · noun

Open authorization

A standard for federated identity management, allowing resource servers or consumer sites to work with user accounts created and managed on a separate identity provider.

The Explain card

Plain English
Open authorization (OAuth) is a standard for federated identity management that lets a resource server or consumer site work with user accounts created and managed by a separate identity provider, without handling the user's password.
Example
A user connects an AI assistant to their cloud storage. OAuth redirects them to the storage provider to approve access, which issues the assistant a scoped token for reading specific folders. The assistant never sees the password and the user can revoke the token later.
Why it matters
AI agents increasingly act on behalf of users across services. OAuth scopes are where defenders enforce least privilege, and over-broad scopes are where breaches begin.
Hook
Valet key, not the master key.

Word knowledge

How the word is built, where it came from, and what it sits beside in memory.

In a sentence

The mobile app uses open authorization to obtain an access token before requesting files from the cloud storage API.

Why these words
  • open Old English open, not closed or obstructed marks the approach as openly specified
  • authorization French autoriser and Medieval Latin auctorizare, to give authority names the granting of permission
Where it came from
Origin
an English compound formed from open and authorization, later associated with the protocol name OAuth
Entered the language
2000s
What changed
open broadened from physical accessibility to publicly available specifications, while authorization narrowed in computing to controlled permission
How it is spelled
Pattern
authorization keeps the productive American English suffix spelling -ization
Pattern
open retains a single p before its unstressed second syllable

Spelled like

  • standardization
  • modernization
  • tokenization
  • opener
  • opening
Broken into chunks
  • open
    • openness
    • reopen
  • author
    • authority
    • authorize
  • ization
    • standardization
    • authentication
What it sits beside

Same subject

  • OAuth
  • access token
  • identity provider
  • resource server
  • federated identity

Same shape

  • open access
  • open standard
  • open source

security tokens

  • access token
  • refresh token

identity and access standards

  • OAuth 2.0
  • OpenID Connect
  • SAML

Where it sits in the deck

Phase 10: Identity, Access, and Cryptographic Foundations

Before examining threats to systems, establish the foundational security primitives — identity, authentication, authorisation, and the cryptography underpinning them.

Neighbours in this phase