# Fine-grained Authorization eBook

This ebook covers the evolution of fine-grained access controls, popular authorization models and example policies, as well as resources to help add fine-grained authorization to your applications.

- What fine-grained access control is and best practices
- When to use RBAC
- When to use ABAC
- When to use ReBAC
- How to combine models

## Fine-grained, real-time access control made easy

Support RBAC, ABAC, and ReBAC out of the box. Enforce in millisecond latency and high availability.

```
allowed {
    ns := time.now_ns()
    day := time.weekday(ns)
    day == data.workdays[_]
}
```

Include environmental attributes in your policies

``` 
allowed {
    input.user.properties.dept == "Sales"
}
```

Use any user-centric attributes in your policies

``` 
allowed {
    ds.check({
        "subject_type": "user",
        "subject_id": input.user.id,
        "relation": "manager",
        "object_type": "user",
        "object_id": input.resource.id
    })
}
```

Make access decisions based on org-chart relationships

``` 
allowed {
    ds.check({
        "subject_type": "user",
        "subject_id": input.user.id,
        "relation": "can_read",
        "object_type": "document",
        "object_id": input.resource.id
    })
}
```

Model your resource hierarchy and enforce fine-grained authorization

``` 
allowed {
    ns := time.now_ns()
    day := time.weekday(ns)
    day == data.workdays[_]
}
```

Include environmental attributes in your policies

``` 
allowed {
    input.user.properties.dept == "Sales"
}
```

Use any user-centric attributes in your policies

Make access decisions based on org-chart relationships

Model your resource hierarchy and enforce fine-grained authorization

``` 
allowed {
    ns := time.now_ns()
    day := time.weekday(ns)
    day == data.workdays[_]
}
```

Include environmental attributes in your policies

- 1
- 2
- 3
- 4

## The best of OPA and Zanzibar

[Topaz](https://www.topaz.sh/?utm_source=fgaebooklp) is an open-source authorization system that allows you to combine RBAC, ABAC, and ReBAC as you see fit.

## Centralized authorization system

Aserto is a unified access control system for your applications, services, and APIs

## Authorization as easy as an API call

[Speak with an engineer](/content/contact-engineer/index.html)