Distributed Authorization in IoT and Edge Cybersecurity: A Standards-Informed Analytical Framework and Taxonomy

Authorization is a core function of access control in distributed systems, where decisions and enforcement may span heterogeneous components and administrative domains. This paper presents a standards-informed taxonomy and applies it in a systematic mapping study of 90 studies on distributed authorization in IoT, edge/fog, sensor/WSN, and vehicular/V2X environments, available from 2020 through June 2026. The studies are classified according to six dimensions: policy governance, decision basis, identity and attribute management, PDP–PEP architecture, trust establishment, and operational assurance and auditability. We also examine their correspondence with authorization-relevant Zero Trust Architecture tenets and analyze the functional roles of distributed ledger technologies and smart contracts. The mapping shows that Distributed PDP/Local PEP is the dominant architectural pattern, while architectural distribution does not necessarily imply decentralized policy governance, identity and attribute management, or trust establishment. Within the mapped corpus, DLTs and/or smart contracts are widely used, but their use alone does not establish decentralization or complete authorization-lifecycle control. Overall, the results support treating distributed authorization as a combination of related but distinct design dimensions and highlight remaining challenges in lifecycle control, interoperability, delegation-oriented authorization, and operational evaluation.