Roles (RBAC)
Permissions as resource and action, grouped into roles, assigned per workspace. Wildcards when you need them.
tickets:reply → role supportAUTHORIZATION
Stop rebuilding roles and permissions.
Roles, permissions and tenants for your B2B app through one API. Every check comes back with the reason, so support and auditors get an answer instead of a guess.
Three models, one engine
Attributes (ABAC)
Conditions with and, or and not: IP ranges, dates, any attribute you pass with the check.
ip in 10.0.0.0/8 and weekdayRelationships (ReBAC)
Owner of, member of, shared with. Tuples for the cases roles can't express.
maria owner doc:q3-planMulti-tenant from the first line
Each customer is a scope; their teams and workspaces sit under it. Roles inherit down the tree, and an explicit deny at any level wins. Unlimited tenants on every plan.
acme · org · role admin
eu-support · workspace · role support
us-sales · workspace · inherits admin
deny billing:export · wins over any allow
Every check says why
The decision names the roles that granted access, the policies that denied it and the scopes it walked. Simulate a change before you make it, and issue a signed receipt when you need proof later.
- Bulk checks, up to 100 per request
- What-if simulation
- HMAC-signed receipts you can verify
{
"allowed": false,
"matchedBy": ["role:admin"],
"deniedBy": ["policy:deny billing:export"],
"scopeChain": ["acme", "us-sales"]
}Fits your stack
- TypeScript SDK
- Go SDK
- Python SDK
- NestJS module
- Express middleware
- Any JWT provider
- SSO · SCIM 2.0
- Signed webhooks
Your agents can use the same roles.
Add Agent Security and every MCP tool call follows the rules you set here.