Access Control

Decide what an identity may do

One environment, one model. Start with roles. Move to attributes or relationships when the product needs it. The check from your app stays the same.

One model per environment
RBAC, ABAC, or FGA. Switch without rewriting call sites.
Checked at the edge
AuthZEN decision API and SDK helpers. Allow or deny, then audit.
Tenant-scoped
Roles, groups, and tuples stay isolated per environment.

Models that ship

Pick the model the environment needs

RBAC is the default. ABAC evaluates Rego. FGA walks relationship tuples. Configuration for unused models is kept when you switch.

console.authdog.com
Authdog console authorization overview with roles, groups, permissions, and CRUD coverage per role

RBAC

How it works

Three steps to production

01

Model

Pick RBAC, ABAC, or FGA for the environment.

02

Enforce

Ask AuthZEN or the SDK before the action runs.

03

Audit

Every allow and deny lands in the trail.

Build with AI

Copy a prompt, ship faster

Ready-made prompts for your favorite AI assistant. Each references real Authdog SDKs, APIs, and documentation.

C

Claude

Anthropic's AI assistant

Implement RBAC for my API...

G

ChatGPT

OpenAI's conversational AI

Set up fine-grained authorization...

→

Cursor

AI-powered code editor

Add attribute-based policies...

Free trial

Request a free trial

Tell us what you're building and we'll get you set up with a trial, plus someone who can answer questions as you evaluate.

  • Full access to the platform while you evaluate it
  • Help wiring it into your stack from someone who knows it
  • Answers on SSO, SCIM, residency, and compliance requirements

We'll only use this to contact you about Authdog.

Read the model, then enforce it

Concepts first, then the console module and the AuthZEN API.

Authorization concepts