# The Case for Centralizing Authorization

This whitepaper explores the business and technical reasons for centralizing authorization. We discuss the headwinds that organizations face when treating authorization as a central concern:

- Expressivity
- Performance
- Isolation
- Integration

Most importantly, we explore solutions that help organizations overcome these headwinds.

## Fine-grained, real-time access control made easy

Support RBAC, ABAC, and ReBAC out of the box. Enforce in millisecond latency and with high availability

```rego
allowed {
    ns := time.now_ns()
    day := time.weekday(ns)
    day == data.workdays[_]
}
```

Include environmental attributes in your policies

```rego
allowed {
    input.user.properties.dept == "Sales"
}
```

Use any user-centric attributes in your policies

```rego
allowed {
    ds.check({
        "subject_type": "user",
        "subject_id": input.user.id,
        "relation": "manager",
        "object_type": "user",
        "object_id": input.resource.id
    })
}
```

Make access decisions based on org-chart relationships

```rego
allowed {
    ds.check({
        "subject_type": "user",
        "subject_id": input.user.id,
        "relation": "can_read",
        "object_type": "document",
        "object_id": input.resource.id
    })
}
```

Model your resource hierarchy and enforce fine-grained authorization

```rego
allowed {
    ns := time.now_ns()
    day := time.weekday(ns)
    day == data.workdays[_]
}
```

Include environmental attributes in your policies

```rego
allowed {
    input.user.properties.dept == "Sales"
}
```

Use any user-centric attributes in your policies

Make access decisions based on org-chart relationships

Model your resource hierarchy and enforce fine-grained authorization

```rego
allowed {
    ns := time.now_ns()
    day := time.weekday(ns)
    day == data.workdays[_]
}
```

Include environmental attributes in your policies

- 1
- 2
- 3
- 4

## The best of OPA and Zanzibar

[Topaz](https://www.topaz.sh/?utm_source=fgaebooklp) is an open-source authorization system that allows you to combine RBAC, ABAC, and ReBAC as you see fit.

## Centralized authorization system

Aserto is a unified access control system for your applications, services, and APIs

## Authorization as easy as an API call

[Speak with an engineer](/content/contact-engineer/index.html)