Attribute-Based Access Control Libraries

CASL is a JavaScript authorization library for defining and enforcing declarative access control rules across both frontend and backend environments. It provides an attribute-based access control system that manages permissions based on user roles and specific object properties. The library is designed for isomorphic access control, allowing a consistent set of permission rules to be shared between a server API and a client interface. It enables the serialization of permission sets as plain data objects to maintain synchronization across these different layers. Its capabilities include trans

Casbin is an authorization library that provides a model-based engine for enforcing access control across diverse application environments. It decouples authorization logic from application code by using a configuration-driven approach, allowing developers to define access rules and evaluation logic independently. The system supports a wide range of access control models, including role-based, attribute-based, and relationship-based patterns, which are evaluated at runtime to determine if a subject is permitted to perform an action on a resource. The project distinguishes itself through a hig

Casbin is an authorization library designed to manage application access control and permissions through a configurable model-based engine. It serves as a centralized system for verifying whether a user has permission to perform specific actions on a resource. The engine supports multiple access control models, including Role-Based Access Control, Attribute-Based Access Control, and Access Control Lists. It allows for the definition of role hierarchies and the evaluation of user, resource, and environment attributes to make access decisions. The library decouples authorization logic from dat

OpenFGA is a fine-grained authorization server and policy decision point that implements relationship-based access control. It serves as a centralized authorization service for evaluating access requests and managing relationship tuples across distributed microservices and multi-tenant environments. The engine combines relationship graphs with attribute-based access control, using the Common Expression Language to evaluate dynamic runtime attributes and conditional access rules. It handles complex hierarchies and nested permissions by traversing chains of associations and parent-child links t

This project is a unified, cloud-native policy engine designed to decouple authorization and security logic from application codebases. It functions as a centralized authorization service that evaluates structured input data against declarative rules, enabling consistent policy enforcement across microservices, infrastructure, and continuous integration pipelines. The engine utilizes a specialized logic programming language to express complex constraints, which are compiled into an optimized intermediate representation for high-performance evaluation. By supporting both sidecar-based deployme

Cerbos is an open-source authorization service that provides a centralized, language-agnostic engine for managing access control. It functions as a policy-as-code platform, allowing teams to define, test, and distribute authorization rules using declarative YAML or JSON configurations. By decoupling access logic from application code, it enables consistent permission enforcement across diverse service stacks. The project distinguishes itself through its ability to translate high-level authorization policies into native database query filters. This capability allows applications to enforce sec

NestJS Access Control is a role-based and attribute-based authorization framework designed for the NestJS ecosystem. It provides a declarative system for securing application routes and resources, allowing developers to enforce granular access policies through metadata-driven decorators. The framework distinguishes itself by supporting hierarchical role inheritance, which enables the resolution of complex permission sets by traversing parent and child role relationships. It also facilitates dynamic authorization management, allowing security rules to be loaded asynchronously from external dat

This project is a reverse proxy server that secures internal web services by enforcing authentication against external identity providers. It acts as a gatekeeper for incoming HTTP traffic, validating user identity before forwarding requests to protected backend applications. By integrating with OAuth2 and OIDC providers, the proxy ensures that only authorized users can access internal resources. The proxy distinguishes itself through its flexible session management and granular access control. It maintains authenticated user state across requests using either encrypted client-side cookies or

The Common Expression Language specification is a formal standard for a non-Turing-complete expression language designed for safe, portable, and fast logic evaluation. It serves as a cross-language logic standard and a declarative policy language, providing a consistent semantic framework for executing boolean expressions and data transformations across different programming environments. This specification acts as an embedded expression engine that allows applications to integrate portable logic for evaluating user-defined configurations. It is specifically designed to enable safe user-defin

laravel-cors is a middleware package for Laravel applications that manages Cross-Origin Resource Sharing. It functions as an HTTP security layer that validates request origins and injects the necessary headers into application responses to control how external domains access a backend API. The project provides a configuration-driven policy engine to match incoming request origins and methods against allowed values. This includes support for wildcard origin matching to authorize multiple trusted domains through a single rule and the automatic handling of pre-flight OPTIONS requests. The syste

Ory Keto is an open-source authorization server that implements Google Zanzibar’s relationship-based access control model. It stores every access relationship as a tuple in a SQL database and exposes a declarative TypeScript-like namespace language for defining object types, relations, and permissions. The service provides bidirectional permission resolution, configurable consistency levels for checks, and dual gRPC and REST APIs for broad integration. Keto extends the Zanzibar model with edge enforcement of access policies, structured compliance auditing of permission decisions, and infrastr