Authorization decides what a signed-in identity may do in this environment. Pick one model. The other models' config is kept if you switch.
Models
- RBAC (default) — roles carry CRUD on resources. Groups inherit roles.
- ABAC — Rego policies over user, resource, and environment attributes.
- FGA — relationship tuples, Zanzibar-style. Managed in Fine-Grained Authorization.
Start with RBAC. Move to ABAC when the decision depends on request context. Move to FGA when permissions inherit through a graph.
The rail changes with the model: RBAC shows Resources / Roles / Groups. ABAC shows Policies. FGA opens its own module, Fine-Grained Authorization.
From the app
The check does not change when you switch models. Use the AuthZEN decision API or the SDK. See Roles & permissions, FGA, and AuthZEN.
Related
| Read | To learn how to |
|---|---|
| Authorization concepts | Compare the three models |
| Fine-Grained Authorization | Model, tuples, assertions, logs |
| Users | Assign roles and groups |
| Audit | Review access decisions |