**Fine-Grained Authorization** is the console module for relationship-based access. It appears in the sidebar when the environment uses the **FGA** [authorization model](/docs/console/authorization). Each environment is one store.

## Getting Started

Four steps, each with a link to the right view. A step is marked done once the data exists: a saved model, at least one tuple, at least one assertion, at least one authorized client.

## Model Explorer

Write the model on the left in the OpenFGA-style language; the graph on the right updates as you type. Types and relations are nodes, solid lines are relations between types, dashed arrows show a relation that is computed from another. **Save** shows an exclamation mark while you have unsaved changes. Every save creates a version; use the version menu to open an earlier one, and the model ID under the editor to reference it from the API. See [FGA](/docs/fga) for the language.

## Tuple Management

Add a tuple with a user (`user:angela`, `group:eng#member`, or `user:*`), an object type and id, and a relation. The relation list comes from your model. Edit or delete a tuple from its card.

The **Query Tool** answers “is user related to object as relation?”. A yes shows the path that granted access, from the user up to the object, and **View Full Tree** lists everyone who holds the relation.

## Developer Mode

Model, tuples and assertions side by side. Add assertions (a user, a relation, an object and the expected result) and **Run All** or **Run Selected**; each shows Pass or Fail. Assertions belong to the model version they were written for. Developer Mode needs at least one tuple.

## Permissions Index

Early access. Precompute what each user can reach for chosen relations, then **Look up** a user to list objects. Request access from the card; once enabled, create an index, rebuild it, or delete it. Deleted indexes stay listed under **Deleted Indexes**.

## Logs

Search recent API activity for the store. Set the UTC time range, press Enter to search, and open a row to see the request and response. Logs are kept for seven days. Filter with `operation:`, `method:`, `status:`, `client:`, `ip:`, `source:` and `model:`.

## Store Settings

The store name and ID (the environment ID), the active model and its ID, and **Authorized Clients**. Create a client with the permissions it needs; the secret is shown once. Revoking a client stops it immediately.

## Related

| Read | To learn how to |
|------|-----------------|
| [FGA](/docs/fga) | Use the model language and the REST API |
| [Authorization](/docs/console/authorization) | Choose between RBAC, ABAC and FGA |
| [Audit](/docs/console/audit) | Review access decisions |