Roles in access tokens are reaching their limits. Modern applications must decide who may do what on which resource, in which context, at which moment. Static roles baked into a token at login can't answer that: they bloat tokens, go stale, and push authorization logic back into application code. With AI agents acting on behalf of users, fine-grained, real-time decisions become essential.

Keycloak has offered powerful Authorization Services for years, yet few teams use them. Proprietary APIs and concepts like RPTs and UMA kept developers away.

AuthZEN changes that. The OpenID AuthZEN Authorization API 1.0 defines a simple, vendor-neutral contract between enforcement (PEP) and decision (PDP) points, and Keycloak now speaks it.

I'll introduce the concepts behind AuthZEN, then dive into Keycloak: how AuthZEN maps onto Authorization Services, how to configure it, and what's still experimental. Expect live demos!

Time to give Keycloak’s Authorization Services a second chance.