Authdog
Se connecter

Access Control

Decide what an identity may do

One environment, one model. Start with roles. Move to attributes or relationships when the product needs it. The check from your app stays the same.

One model per environment
RBAC, ABAC, or FGA. Switch without rewriting call sites.
Checked at the edge
AuthZEN decision API and SDK helpers. Allow or deny, then audit.
Tenant-scoped
Roles, groups, and tuples stay isolated per environment.

Models that ship

Pick the model the environment needs

RBAC is the default. ABAC evaluates Rego. FGA walks relationship tuples. Configuration for unused models is kept when you switch.

RBAC

Roles carry CRUD on resources. Groups inherit those roles. The default for most apps.

  • Resources and roles in the console
  • Groups and SCIM sync
  • SDK permission checks

Groups

Assign once to the group. Users inherit. Directory sync maps IdP groups onto roles.

  • Members and permissions tabs
  • SCIM group mapping
  • Cross-application reuse

ABAC

Rego policies over user, resource, and environment attributes. Built-in policy engine.

  • Versioned per environment
  • Context on every request
  • Same decision API as RBAC

FGA

Zanzibar-style tuples. Inherited permissions through a graph of objects.

  • Relationship editor
  • Playground in the console
  • AuthZEN ListObjects

Free trial

Request a free trial

Tell us what you're building and we'll get you set up with a trial, plus someone who can answer questions as you evaluate.

  • Full access to the platform while you evaluate it
  • Help wiring it into your stack from someone who knows it
  • Answers on SSO, SCIM, residency, and compliance requirements

We'll only use this to contact you about Authdog.

01

Model

Pick RBAC, ABAC, or FGA for the environment.

02

Enforce

Ask AuthZEN or the SDK before the action runs.

03

Audit

Every allow and deny lands in the trail.

Read the model, then enforce it

Concepts first, then the console module and the AuthZEN API.

Authorization concepts