ASP.NET Core Identity supports the essentials for authentication and authorisation across many application types such as web, API, and mobile. With Identity, authorisation is a breeze! Developers can implement authorisation checks using numerous methods including roles, claims, and policies. However, this approach is not without limitations. For example, updating authorisation requirements will require code changes, along with the time taken to test and deploy these changes. Checking user or role permissions is also tricky, you'll need to review the code or documentation - and hope the documentation is still up to date! As systems grow, authorisation requirements will grow, and these limitations can slow new development and decrease maintainability. In this talk, I'll demonstrate an approach using permission-based authorisation to overcome these limitations and improve the flexibility and visibility of access control across your system. Check out our new channel: NDC Clips: @ndcclips Check out more of our featured speakers and talks at https://ndcconferences.com/ https://ndcoslo.com/