openfga/openfga

Features

• Relationship-Based Access Controls - Implements a security model that manages permissions by defining relationships between subjects and objects.
• Authorization Services - Provides a centralized service that acts as a single source of truth for permission decisions across microservices.
• Fine-Grained Permission Checking - Evaluates access requests via high-performance APIs to determine if a user is authorized to perform a specific action.
• Fine-Grained Access Control - Implements precise, object-level authorization mechanisms using relationship tuples and conditional logic.
• Agent Access Controls - Defines and enforces precise access limits and operational scopes for autonomous AI agents.
• Model Specifications - Provides a domain-specific language for defining the object types and relationships that govern all access control logic.
• Relationship Data Storage - Provides a specialized persistence layer for storing subject-object relationship tuples used in access control decisions.
• ReBAC Engines - Implements a Relationship-Based Access Control (ReBAC) engine to manage complex hierarchies and nested permissions.
• Permission Inheritance Management - Assigns permissions to user groups and handles the inheritance of those permissions through membership.
• Relationship-Based Models - Specifies authorization logic using a domain-specific language to define relationships, roles, and attribute-based conditions.
• Group-Based Access Controls - Grants relations or permissions to a set of users by linking group objects to specific resources.
• Attribute-Based Access Control - Implements a framework that evaluates authorization requests using dynamic runtime attributes and contextual data.
• Authorization Logic - Provides a centralized source of truth for authorization logic and relationship data used across all services.
• Authorization Model Management - Provides tools to write, retrieve, and version the logic that defines how access is granted.
• Authorization Query Engines - Evaluates access requests via network calls or embedded libraries to deliver real-time permission decisions.
• Request-Time Attribute Processing - Processes dynamic data provided at request time, like IP addresses, to evaluate conditional access rules.
• Hybrid Relationship-Attribute Access Systems - Combines relationship graphs with dynamic runtime attributes using Common Expression Language for conditional access.
• Tuple Lifecycle Management - Manages the creation and removal of associations between users and objects with support for atomic updates.
• Graph-Based Authorization Checks - Evaluates access requests by analyzing a graph of relationship tuples and hierarchical parent-child links.
• Agent Identities - Assigns unique identities and granular, task-specific permissions to autonomous AI agents as first-class principals.
• Relationship-Based Permission Checks - Evaluates access requests by analyzing relationship tuples to deliver real-time permission decisions with high performance.
• Multi-Tenant Isolation Layers - Ensures strict data and permission separation across multiple tenants within a single authorization store.
• Non-Human Principal Modeling - Treats automated agents as first-class identities within a permission hierarchy to manage their access.
• Contextual Permission Verification - Evaluates access requests using temporary, non-persistent relationship tuples provided at runtime.
• Permission Management - Manages billions of relationship tuples with millisecond latency for thousands of requests per second.
• Policy Decision Points - Serves as a policy decision point that evaluates authorization logic to return real-time permission decisions.
• Request-Time Context Evaluation - Evaluates authorization requests using temporary, non-persistent attributes provided during the session.
• Graph Traversal Engines - Resolves indirect permissions by traversing chains of associations and hierarchical parent-child links.
• Authorization Model Pipelines - Enables automated testing and deployment of authorization models through CI pipelines.
• Concurrent Update Resolution - Resolves conflicts during simultaneous writes to the authorization store to maintain data consistency.
• Atomic Transaction Coordinators - Ensures data consistency by coupling database writes and authorization changes using a transactional outbox pattern.
• Authorization Result Caches - Caches authorization decisions in memory to minimize latency for repetitive access checks.
• Public Access Controls - Grants permissions to all users of a specific type to enable open access to objects.
• Authorized ID Retrieval - Fetches a list of resource identifiers a user has permission to access to facilitate efficient database filtering.
• Authorization Schema Managers - Maintains immutable iterations of authorization logic to enable safe transitions and consistent behavior.
• Authorization Relations - Defines authorization relations where possessing one specific relationship automatically grants another within a hierarchy.
• Multi-Tenant Data Management - Ensures strict tenant separation by isolating data and permissions across different organizations.
• Pluggable Database Backends - Supports diverse data stores including PostgreSQL, MySQL, and SQLite for relationship tuple storage.
• Authorization Store Backends - Supports persisting authorization tuples and models across PostgreSQL, MySQL, and in-memory storage.
• Read Replicas - Scales read throughput by distributing authorization queries across PostgreSQL replicas.
• Relationship Change Retrievals - Provides paginated lists of relationship changes to allow external systems to synchronize their local authorization state.
• Authorization-Based Search Filtering - Filters database search results by verifying user permissions for each record using high-performance batch requests.
• Local Permission Index Syncing - Consumes a stream of authorization changes to maintain a local cache for high-performance permission intersections.
• Relationship - Maintains a queryable history of relationship updates to provide a full audit trail of permission changes.
• CLI Administration Tools - Provides a command line tool to manage stores, import/export models, and handle data migration.
• Policy-as-Code Definitions - Implements authorization logic as version-controlled code to enable automated testing and safe deployments via CI/CD pipelines.
• Gradual Rollouts - Supports gradual rollouts of new authorization logic via shadow checks and traffic shifts to validate changes.
• Immediate Permission Revocation - Removes relationship tuples to instantly strip a user of all inherited group permissions.
• Nested Group Memberships - Supports inherited access by allowing groups to be members of other groups.
• Scoped Permission Assignments - Grants access to principals at varying levels of granularity, ranging from organization-wide inheritance to direct object assignments.
• Authorization Type Definitions - Creates distinct types for application resources to ensure precision in permission queries and compliance auditing.
• Batch Authorization Evaluators - Evaluates multiple authorization requests in a single batch call with configurable short-circuiting to reduce latency.
• Conditional Access Restrictions - Restricts actions based on runtime parameters or object states to ensure dynamic access control.
• Usage-Based Access Restrictions - Restricts permissions based on quantitative metrics and request context, such as time-based expiration or call counts.
• External Resource Sharing - Grants specific users from different organizations access to individual resources across tenant boundaries.
• Role Inheritance Resolution - Implements concentric relation models where high-level roles inherit all permissions from lower-level roles via graph traversal.
• Accessible Resource Querying - Implements reverse lookups to identify all objects a principal is authorized to access.
• Ownership-Based Access Controls - Establishes ownership relations between parent and child objects to restrict and determine resource access.
• Granular Permission Systems - Creates distinct relations to differentiate between general and privileged access based on data sensitivity.
• Permission Inheritance - Implements mechanisms that propagate security settings and permissions from parent resources to their children.
• Relationship Expansion - Retrieves a full tree of users and usersets that hold a specific relationship to an object.
• Runtime Relationship Injection - Allows temporary relationship data to be processed during a single request without persisting it to the store.
• Permitted Action Discoveries - Provides an API to discover all actions a user can perform on a resource to dynamically update UI elements.
• Model Versioning - Supports immutable versioning of authorization models to maintain consistency and enable safe transitions between policy iterations.
• Custom Role Definitions - Allows the creation of user-specified roles and permissions defined at the individual object level.
• Runtime Role Creation - Enables the creation of arbitrary sets of roles and their association with permissions at runtime.
• Just-in-Time Access - Restricts permission to resources for specific time windows by evaluating the current time during the access check.
• Permission Delegation - Grants autonomous agents bounded access to resources through explicit relationships for specific tasks.
• Transitive Permission Rule Definitions - Defines hierarchical relationship rules where permissions on a parent object automatically grant access to its children.
• Bulk Tuple Writes - Modifies access for large sets of resources simultaneously via high-performance batch writes.
• Model Version Pinning - Locks API requests to a specific model version to ensure consistent authorization behavior and performance.
• OpenFGA Authorization Integration - Connects applications via language-specific libraries to verify permissions and manage relationships using an external server.
• Accessible Resource Filtering - Provides the ability to return a list of objects a user is permitted to interact with to filter client views.
• Role-Based Access Control - Assigns permissions to users through the definition and assignment of static or custom roles.
• Union Conditions - Implements authorization logic that grants access if any one of several relationship criteria is satisfied.
• Authorized Subject Listing - Retrieves all users or identities that hold a specific permission to act upon a given resource.
• Access Logic Validations - Runs predefined test cases against models and tuples to validate that authorization rules behave as expected.
• Access Exclusion Lists - Prevents specific users or groups from accessing resources by applying an explicit exclusion operator.
• Authorization Tuple Injection - Processes temporary relationship data at request time to support dynamic and situational access rules.
• Authorization Model Testing - Validates authorization logic by running predefined tests against a model to ensure expected results.
• Expression Languages - Evaluates dynamic attribute-based conditions during authorization checks using a standardized expression language.
• Multi-Object Permission Verification - Checks authorization for a large set of objects in a single request to reduce latency.
• Authorization Schemas - Uses language definitions to map relationships to permissions, eliminating the need for manual tuning of access rules.
• Transactional Outbox Patterns - Ensures data consistency by coupling database writes with authorization changes using a transactional outbox pattern.
• Access Control Synchronizers - Reconciles authorization states between two systems using full or differential synchronization of relationship tuples.
• Permission Auditing Tools - Identifies which users hold specific permissions at a given time to ensure security compliance.
• Relationship-Based Grouping - Groups users into sets based on their relationship to an object to manage access in bulk.
• Security And Privacy - High-performance authorization engine.
• Security & Privacy - Fine-grained authorization engine based on Zanzibar.

Star history