Author and test fine-grained authorization in the console
Write FGA models in a Monaco DSL editor, inspect the tuple graph, and run relationship checks in an interactive playground.
From the changelog: Fine-grained authorization model editor and playground
Authdog Team
Fine-grained authorization is easy to get wrong in a text file and harder to debug after it is live. Teams using Authdog FGA can now author the model, inspect relationship tuples, and evaluate checks in the same console module.
This is the longer note behind the August 27 changelog entry.
What shipped
The Authorization module (when the environment permission model is FGA) includes:
- A model editor with a custom Monaco language for the FGA DSL
- A live tuple graph of stored relationships
- A playground with chips for relationship and evaluation checks
- Rego diagnostics in the ABAC policy editor for environments on ABAC
GraphQL and the FGA console API cover model and tuple management (envFgaModel, relation tuples, playground check and eval). The older Shelter page is not the live UI; Authorization > Relationships is.
How a check works
You write types and relations in the model, then store tuples such as user:ada related to document:q3 as editor. The playground sends a check (subject, relation, object) to the FGA evaluator and returns allow or deny against the current model and tuples.
The graph is a view of stored tuples, not a separate source of truth. Edit the model or tuples, then re-run the playground before you rely on the result in an app.
Set it up
- Set the environment permission model to FGA.
- Open Authorization.
- Author or paste the model in the Model tab and save.
- Add relationship tuples on Relationships.
- Use Playground to check a subject/relation/object triple.
- Use Graph to see how those tuples connect.
Keep model edits in a reviewable change. A saved model is what the evaluator uses on the next check.
Trust boundaries
FGA decides authorization for resources you model. It does not authenticate the user. Session and token issuance stay on the identity path; the app still has to pass the authenticated subject into the check.
Playground results reflect the tuples in that environment. Do not treat a playground allow as a production grant unless those tuples are the ones your services read.
Try it
Open Authorization in an FGA environment and run a check in the playground. The original release note is in the changelog.