What Is User Managed Access?
Security Boulevard, Monday, January 26th, 2026
Ever tried to share a medical record with a specialist or let a tax app see your bank data without just handing over your password? It's usually a mess of "all or nothing" permissions that makes security teams lose sleep.
User Managed Access, or uma, is basically oauth2 but with a brain for privacy. It lets the actual owner of the data-not just the admin-decide who gets in.
Traditional oauth is great for "I let this app post to my feed," but it fails when you want to share your stuff with someone else. UMA 2.0 fixes this by adding a centralized way to manage these messy relationships.
To get this working, you need a few moving parts talking to each other: