Authorization decides what a signed-in identity may do in this environment. Pick one model. The other models' config is kept if you switch.
Models
- RBAC (default) — roles carry CRUD on resources. Groups inherit roles.
- ABAC — Rego policies over user, resource, and environment attributes.
- FGA — relationship tuples, Zanzibar-style. Managed in Fine-Grained Authorization.
Start with RBAC. Move to ABAC when the decision depends on request context. Move to FGA when permissions inherit through a graph.
The rail changes with the model: RBAC shows Resources / Roles / Groups. ABAC shows Policies. FGA lists Getting Started, Model Explorer, Tuple Management, Developer Mode, Permissions Index, Logs, and Store Settings. Those open Fine-Grained Authorization. Choosing FGA opens Getting Started. An FGA item also appears under Identity.
From the app
The check does not change when you switch models. Use the AuthZEN decision API or the SDK. See Roles & permissions, FGA, and AuthZEN.
Related
| Read | To learn how to |
|---|---|
| Authorization concepts | Compare the three models |
| Fine-Grained Authorization | Model, tuples, assertions, logs |
| Users | Assign roles and groups |
| Audit | Review access decisions |