Fine-Grained Access Control (FGAC)
Authorization that evaluates permissions at the individual resource or action level, rather than broadly by user type or role.
Fine-grained access control (FGAC) is an authorization model where permissions are evaluated at the level of individual resources and actions, rather than broadly granting or denying access by user group or role alone.
In coarse-grained access control, you might say "admins can do everything" or "users can read." In fine-grained access control, you express: "user Alice can read and update invoice #1234, but not delete it; user Bob can only read it."
Why fine-grained matters
The principle of least privilege requires that each subject has exactly the access it needs — no more. Coarse-grained models over-provision access because the granularity doesn't exist to express precise permissions. This creates security risk and compliance problems.
FGAC is especially important in multi-tenant SaaS where customer data must be isolated: a user in Tenant A should never be able to access resources in Tenant B, even if they hold the same "admin" role in both contexts.
FGAC in WardenAuth
WardenAuth implements FGAC via a scope-permission-role model:
- Permissions: define what actions can be performed on what resources (e.g.,
invoice:delete) - Roles: bundle permissions together (e.g.,
billing-adminincludesinvoice:delete) - Scopes: isolate RBAC configurations per tenant
- Access policies: bind subjects (users) to roles within a scope
// Check fine-grained access: can this user delete this invoice?
const res = await fetch('https://api.wardenauthz.com/v1/has-access', {
method: 'POST',
headers: { 'x-api-key': process.env.RBAC_API_KEY },
body: JSON.stringify({
subjectId: user.id,
scopeId: workspace.tenantId,
resource: 'invoice',
action: 'delete',
}),
})
const { allowed } = await res.json()Related terms
Role-Based Access Control (RBAC) grants permissions via roles. Attribute-Based Access Control (ABAC) evaluates arbitrary attributes (user, resource, environment) against policy rules.
An authorization evaluation rule where an explicit deny on any matching permission overrides all allow permissions. Used to enforce least-privilege without restructuring role hierarchies.
A binding between a subject (user or service) and one or more roles within a scope. Defines what the subject can do in that tenant context.
A logical isolation boundary in a multi-tenant system. Permissions, roles, and access policies in one scope are completely independent from those in another.