Permissions that grow with your app Available
Start with teams and roles. Grow into fine-grained permissions, explicit denies, audit trails, and API keys — without ever rewriting your authorization layer or slowing down a request. Checks stay one database read no matter how complex your rules get.
The hot path is one read
Effective permissions are materialized into documents at write time. A check fetches one document and evaluates locally: explicit denies first (a deny always wins), allows capped by boundaries, then an optional grant fallback. No policy engine, no graph traversal, no network hop in the middle of your request path.
const result = await checker.hasPermission(
'user-alice',
'read',
'device',
'tenant-prod',
{ explain: true }
)With explain: true, the result names the assignment, policy, boundary, or deny that decided it — the raw material for “why can't I do this?” UI.
The model
Orgs contain tenants; users join tenants and groups; roles carry permissions with can/denyeffects; policies add conditions — on server-derived request facts (MFA, IP, time) or on resource attributes your backend attests, like “edit your own notes”; boundaries cap what any assignment can grant; grants cover narrow or temporary access with expiry.
Operations
Bulk changes propagate through async cascades with repair jobs. Freshness metadata makes staleness observable. Every authorization-relevant change lands in the audit trail.
Admin surfaces
A hosted Admin Console for Customer Admins, an iframe embed, and embeddable widgets for your own product — all over one headless SDK.