# Overcoming access control challenges

Authorization poses a unique challenge for multi-tenant applications. It's in the critical path of every application request, so it has to make decisions with minimum latency and maximum availability. This guide teaches you how to overcome these challenges by:

- Extracting policy logic from application code
- Applying the principle of least privilege
- Enforcing locally against real-time data
- Centrally managing policies and decision logs

#### Get the guide

## Easily add fine-grained, policy-based, real-time access control to your cloud applications and APIs.

## Fine-grained, policy-based access control

Grant access to your applications based on your user attributes, resource hierarchy, and relationships between them.

```plaintext
allowed {
ns := time.now_ns()
day := time.weekday(ns)
day == data.workdays[_]
}
```

Include environmental attributes in your policies

```plaintext
allowed {
input.user.properties.dept == "Sales"
}
```

Use any user-centric attributes in your policies

```plaintext
allowed {
ds.check({
    "subject_type": "user",
    "subject_id": input.user.id,
    "relation": "manager",
    "object_type": "user",
    "object_id": input.resource.id
})
}
```

Make access decisions based on org-chart relationships

```plaintext
allowed {
ds.check({
    "subject_type": "user",
    "subject_id": input.user.id,
    "relation": "can_read",
    "object_type": "document",
    "object_id": input.resource.id
})
}
```

Model your resource hierarchy and enforce fine-grained authorization

```plaintext
allowed {
ns := time.now_ns()
day := time.weekday(ns)
day == data.workdays[_]
}
```

Include environmental attributes in your policies

- 1
- 2
- 3
- 4

## Enforce in milliseconds

Make authorization decisions in milliseconds against real-time user attributes and resource data.

## Centralized policy management

Define and manage all of your policies from one central location.

## Policy lifecycle management

Extract policy from application code and convert it to immutable images that can be signed, verified, and versioned.

## Tell us about your access control challenges

[Speak with an engineer](/content/contact-engineer/index.html)