{
  "id": 10896979,
  "title": "Login events are not authorization evidence",
  "url": "https://urgent.news/2026/09/30/login-events-are-not-authorization-evidence",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-30T08:27:34.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/authbyexample1/login-events-are-not-authorization-evidence-98j"
  },
  "original_language": "en",
  "account": null,
  "summary": "When regulators ask you to \"prove it,\" IdP logs only get you partway. They show that someone authenticated. They do not show why that person was allowed to export an invoice, approve a payout, or read another tenant's data. That proof maps to a runtime architecture: PEP — enforce the decision in the app/API/gateway PDP — evaluate policy close to the app (hybrid/local beats remote-only on the hot…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}