My son finds all sorts of ways to break out of his bedtime routine. He climbs out of bed, crawls out of the bedroom, and makes a dash for the front door. His favorite book is Goodnight Gorilla, a story about animals escaping from the zoo with help from a thieving gorilla. What’s that got to do with APIs and OAuth? Well, you see, the gorilla got a hold of the zookeeper’s keys (ahem, token?) and was able to let loose a horde of animals. Are your APIs like that zoo? Do you know who can access which feature, transaction, or data item? What if a monkey wreaked havoc in your apps? This session introduces policy-based access control (PBAC), a novel approach to fine-grained access control for your APIs. We’ll illustrate how you can easily write and deploy policies and tackle common security challenges as highlighted in the OWASP API Top Ten. We’ll also touch on the latest innovations such as OpenID AuthZEN and ALFA. Attendees will walk away with a clear understanding of access control for APIs and what options they have to secure their environments.