**Authorization** decides what a signed-in identity may do in this environment. Pick **one** model. The other models' config is kept if you switch.

## Models

- **RBAC** (default) — roles carry CRUD on resources. Groups inherit roles.
- **ABAC** — Rego policies over user, resource, and environment attributes.
- **FGA** — relationship tuples, Zanzibar-style.

Start with RBAC. Move to ABAC when the decision depends on request context. Move to FGA when permissions inherit through a graph.

The rail changes with the model: RBAC shows Resources / Roles / Groups. ABAC shows Policies. FGA shows Relationships.

## From the app

The check does not change when you switch models. Use the AuthZEN decision API or the SDK. See [Roles & permissions](/docs/permissions), [FGA](/docs/fga), and [AuthZEN](/docs/authzen).

## Related

| Read | To learn how to |
|------|-----------------|
| [Authorization concepts](/docs/concepts/authorization) | Compare the three models |
| [Users](/docs/console/users) | Assign roles and groups |
| [Audit](/docs/console/audit) | Review access decisions |