Authorization

Authorization that scales with you

Enforce least-privilege access with groups, roles, and fine-grained permissions, from a single app to multi-tenant estates, without rewriting your auth stack.

Sub-10ms checks: Permission decisions evaluated at the edge, close to your users.
Tenant-scoped by default: Roles, groups, and policies stay isolated per tenant and environment.
Audited end to end: Every access decision is recorded and queryable for compliance.
One SDK call: Check access from Node.js, Python, Go, and the REST API.

Flexible models

One platform, every authorization model

Start with simple roles and evolve to attribute- and relationship-based policies as your product grows. No migration required.

RBAC

Assign roles to users and let roles carry permissions. The workhorse of SaaS authorization.

Predefined role templates
Tenant-scoped roles
Role hierarchy inheritance

Groups and memberships

Model teams the way your customers do, then attach permissions to the group instead of to each user.

Attach permissions to a group once
Sync membership from directories and SCIM
Cross-application group reuse

ABAC

Coming soon

Evaluate user attributes, resource properties, and context to make dynamic access decisions.

Context-aware policies
Time and IP conditions
Custom attribute matching

ReBAC

Coming soon

Model complex hierarchies like organizations, workspaces, and projects, with permissions that inherit naturally.

Resource hierarchy
Permission inheritance
Cross-tenant relationships

Model

Define roles, groups, and permissions per tenant and environment.

Enforce

Check access with one SDK call before sensitive actions run.

Audit

Review every allow and deny decision from a single trail.

Ready to tighten access without friction?

Open the console to model groups, attach permissions, and align policy with how your teams ship.

Start Building