Fine-Grained Authorization

Fine-Grained Authorization is the console module for relationship-based access. It appears in the sidebar when the environment uses the FGA authorization model. Each environment is one store.

Getting Started

Four steps, each with a link to the right view. A step is marked done once the data exists: a saved model, at least one tuple, at least one assertion, at least one authorized client.

Model Explorer

Write the model on the left in the OpenFGA-style language; the graph on the right updates as you type. Types and relations are nodes, solid lines are relations between types, dashed arrows show a relation that is computed from another. Save shows an exclamation mark while you have unsaved changes. Every save creates a version; use the version menu to open an earlier one, and the model ID under the editor to reference it from the API. See FGA for the language.

Tuple Management

Add a tuple with a user (user:angela, group:eng#member, or user:*), an object type and id, and a relation. The relation list comes from your model. Edit or delete a tuple from its card.

The Query Tool answers “is user related to object as relation?”. A yes shows the path that granted access, from the user up to the object, and View Full Tree lists everyone who holds the relation.

Developer Mode

Model, tuples and assertions side by side. Add assertions (a user, a relation, an object and the expected result) and Run All or Run Selected; each shows Pass or Fail. Assertions belong to the model version they were written for. Developer Mode needs at least one tuple.

Permissions Index

Early access. Precompute what each user can reach for chosen relations, then Look up a user to list objects. Request access from the card; once enabled, create an index, rebuild it, or delete it. Deleted indexes stay listed under Deleted Indexes.

Logs

Search recent API activity for the store. Set the UTC time range, press Enter to search, and open a row to see the request and response. Logs are kept for seven days. Filter with operation:, method:, status:, client:, ip:, source: and model:.

Store Settings

The store name and ID (the environment ID), the active model and its ID, and Authorized Clients. Create a client with the permissions it needs; the secret is shown once. Revoking a client stops it immediately.

Related