GOVERNATLAS / PRODUCT DOSSIER

Keycloak

Keycloak Authorization Services documents protected resources and scopes, permissions and policies, and integration with policy enforcement points. Keycloak documents authorization responses through requesting-party tokens and distinguishes a denied authorization response from an unexpected error.

Explore the product ↗Add to comparison ↗

01 / CONTEXT & SCOPE

Understand the proposition.
Define the boundary.

Where it fits

Authentication and authorization answer different questions.

The decision to make

Authentication and authorization answer different questions. A successful login does not establish permission to read or change a resource. For this profile, scope the evaluation to Authorization Services and the application’s enforcement integration. Ask where a permission decision is checked, what token is accepted and whether an alternate application route bypasses the same enforcement point.

What this record does not establish

The guide is first-party technical documentation. It does not establish that a particular application correctly implements enforcement, immediately invalidates existing sessions or provides enterprise access certification. Record the deployed release and adapter/API choices.

1 current source · 2 published assertions
Source coverage is a research boundary, not a quality score.

02 / YOUR EVALUATION

Turn interest into a useful trial.

Open the evaluation playbook ↗

A test worth running

Use a fictional resource with separate view and edit scopes. Request a narrow token, attempt an authorized read and a denied write, then repeat through an alternate route. Change the policy and compare fresh-token behavior with an already issued token. Interrupt the authorization dependency and record whether the application distinguishes denial from an unresolved error.

GovernAtlas editorial proposal. We have not performed this test.

Evidence to bring back

A resource/scope/policy/enforcement map and the exact token path used in the test.
Separate read, write, policy-change and dependency-failure observations with unresolved paths retained.

THE OPERATING DETAIL

Follow the decision into the enforcing system.

GovernAtlas analysis: practical review considerations, not findings from a product test.

Set the operating boundary

A successful login does not establish permission to read or change a resource. For this profile, scope the evaluation to Authorization Services and the application’s enforcement integration. Ask where a permission decision is checked, what token is accepted and whether an alternate application route bypasses the same enforcement point.

A proposed buyer demonstration

What the evidence does not establish

03 / DOCUMENTED EVIDENCE

Read the claim. Inspect the basis.

Each statement retains its classification and preserved source. A vendor assertion is not an independent test result.

first party asserted

Keycloak documents authorization responses through requesting-party tokens and distinguishes a denied authorization response from an unexpected error.

Source, dates & preserved provenance

Keycloak — current primary scope ↗

Authority: first party
Observed 2026-10-18 · Reviewed 2026-10-18 · current until 2026-11-17

Artifact SHA-256: b22b3c0856459d88f02c05d36339b649fa142d515675e5bc54df87e89324b82d

The hash identifies the preserved capture. The live source may have changed.

first party asserted

Keycloak Authorization Services documents protected resources and scopes, permissions and policies, and integration with policy enforcement points.

Source, dates & preserved provenance

Keycloak — current primary scope ↗

Authority: first party
Observed 2026-10-18 · Reviewed 2026-10-18 · current until 2026-11-17

Artifact SHA-256: b22b3c0856459d88f02c05d36339b649fa142d515675e5bc54df87e89324b82d

The hash identifies the preserved capture. The live source may have changed.

Source register

Keycloak — current primary scope ↗first party · captured 2026-10-18

Brand asset provenance

Organization identity asset from its official website; inclusion does not imply endorsement.

Official website ↗ · Original asset ↗

04 / BEFORE YOU COMMIT

Better questions.
A clearer decision.

Resolve these with the provider and your own evaluation team.

Can you demonstrate and export: A resource/scope/policy/enforcement map and the exact token path used in the test.

Can you demonstrate and export: Separate read, write, policy-change and dependency-failure observations with unresolved paths retained.

Regulatory applicability requires a separate, current determination. Inclusion is not certification.

COMPLIANCE / CLAIMS, SCOPE & GAPS

Start with the requirement.
Inspect the support.

Prepare your vendor review ↗

These labels describe this dossier’s current evidence coverage. A published mention may be a framework mapping, a qualified assertion or a limitation; it is not a compliance finding.