Service-level authorization policy management

Abstract

Systems and methods are described to identify and correct inaccurate or non-compliant access policies for an authorization service that uses such policies to control access to instances of one or more network-accessible services. Each service can implement one or more instances on behalf of individual service users, which users can author an access policy to control whether requests to access the instances are allowed or disallowed at the authorization service. The access policies can be authored according to policy guidelines established by the service. If the policy guidelines of a service change (e.g., are updated to a new version), the authorization service can detect policies non-compliant with the changed guidelines, and notify service users of the non-compliant policies. The authorization service may further notify users of modifications or transformations to bring access policies into compliances with changed policy guidelines.