The Stormpath API shut down on August 17, 2017. Thank you to all the developers who have used Stormpath. This article discusses how security policies are managed using the concept of Roles and how the predominant role-based mechanism for securing applications is largely insufficient. I discuss what I believe is a much better way of securing applications. What is a Role? When speaking about applic