Fine-Grained Authorization (FGA)
Authorization at the level of individual resources or fields, rather than at the application or role level. Critical for multi-tenant SaaS, collaborative documents, and sharing patterns. ReBAC is the dominant implementation pattern.
Fine-grained authorization is the problem roles cannot solve: "can this user view this specific document" depends on relationships that change constantly and are owned by the application, not by the directory. Google's Zanzibar paper made relationship-based checks the dominant pattern, and the open implementations that followed made it buildable. The hard parts are consistency (a permission check that reads stale data grants stale access) and latency, since every request needs a decision.
See also: ReBAC, ABAC, RBAC vs ABAC vs ReBAC, authorization vendors
Related on Start with Identity
- GlossaryRBAC
Role-Based Access Control. Permissions are bundled into roles, users are assigned roles. Simple to understand and audit, but role explosion is a common failure
- RankingBest Authorization Tools: Top 5 Fine-Grained Authorization Engines
The top 5 authorization tools (Styra/OPA, AuthZed, OpenFGA, Cerbos, Permit.io), scored on a 10-dimension rubric, spanning policy-as-code and Zanzibar-style ReBA
- GlossaryAccess Certification
Periodic review of who has access to what, with managers or resource owners attesting that access is still appropriate. A regulatory requirement in many industr
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- GuideAuthentication vs Authorization: The Difference That Trips Everyone Up
Authentication and authorization sound alike and are often shortened to the same "authZ/authN," but they answer different questions. Getting them straight is fo
- BlogC1 ships enterprise-managed authorization, putting SSO in front of MCP agents
The identity platform formerly called ConductorOne now issues short-lived scoped tokens for MCP servers under the open enterprise-managed authorization extensio