The client sends a request. The server checks the token. But not just any check — the rules change depending on who you are, what you can do, and what part of the system you touch. This is the world of fine-grained access control with OpenID Connect (OIDC).
Fine-grained access control is more than deciding between “allow” or “deny.” It means enforcing precise authorization policies that depend on context, resource scope, user attributes, and dynamic conditions. With OIDC, you gain an identity layer on top of OAuth 2.0 that integrates cleanly with JSON Web Tokens (JWT), making these rules enforceable at scale and in real time.
Standard OIDC flows authenticate users and issue ID tokens. To make access control fine-grained, you embed scopes, claims, and custom attributes into those tokens. Scopes define the boundaries of permission. Claims add structured detail — such as roles, departments, project IDs, and security clearance levels. Resource servers read these claims and decide access down to the individual field, method, or data record.
The key is tight integration between your OIDC provider and your policy engine. Your provider must support custom claims and dynamic token generation. Your policy engine must evaluate these claims with zero delay for every API call. This can be done by pairing OIDC with authorization frameworks like Open Policy Agent (OPA), or integrating directly with application middleware that interprets claims in real time.