The Architecture of Scalable, Granular Authorization
The Architecture of Scalable, Granular Permissions
Explore the evolution of authorization and the latest breakthroughs in fine-grained access control. You'll learn:
- Why authorization is still an "N * M" problem
- A real-world implementation of a fine-grained authorization system
- Why a distributed system architecture is required for FGA
- Open-source projects you can use as the foundation of your authz service
Watch it now!
Everything you need to know about resource-level, real-time authorization systems for applications
Any application
Add granular permissions to any application in mins and be production ready in <2 weeks
const { jwtAuthz } = require("@aserto/aserto-node")
const checkAuthz = jwtAuthz({ ... })
// ...
app.get("/protectPath/:param", checkJwt, checkAuthz,
async (req, res) => { ... }
)
Node
Go
Python
Java
.NET
Ruby
Roles, attributes & relationships
Authorize based on roles (RBAC), attributes (ABAC), relationships (ReBAC), or combinations
allowed {
ns := time.now_ns()
day := time.weekday(ns)
day == data.workdays[_]
}
Include environmental attributes in your policies
allowed {
input.user.properties.dept == "Sales"
}
Use any user-centric attributes in your policies
allowed {
ds.check({
"subject_type": "user",
"subject_id": input.user.id,
"relation": "manager",
"object_type": "user",
"object_id": input.resource.id
})
}
Make access decisions based on org-chart relationships
allowed {
ds.check({
"subject_type": "user",
"subject_id": input.user.id,
"relation": "can_read",
"object_type": "document",
"object_id": input.resource.id
})
}
Model your resource hierarchy and enforce fine-grained authorization
allowed {
ns := time.now_ns()
day := time.weekday(ns)
day == data.workdays[_]
}
Include environmental attributes in your policies
- 1
- 2
- 3
- 4
Fine-grained permissions
Give users access to what they need, when they need it
~1ms authorization
Make authorization decisions in ~1 millisecond with Aserto
Real-time data
Authorize based on the most up-to-date policy, user, and resource information
Open foundation
Aserto is built on top Topaz. It adds a central control plane and high-speed data fabric to allow for real-time authorization