Fine-Grained Authorization (FGA)
Authorization at the level of individual resources or fields, rather than at the application or role level. Critical for multi-tenant SaaS, collaborative documents, and sharing patterns. ReBAC is the dominant implementation pattern.
Fine-grained authorization is the problem roles cannot solve: "can this user view this specific document" depends on relationships that change constantly and are owned by the application, not by the directory. Google's Zanzibar paper made relationship-based checks the dominant pattern, and the open implementations that followed made it buildable. The hard parts are consistency (a permission check that reads stale data grants stale access) and latency, since every request needs a decision.
See also: ReBAC, ABAC, RBAC vs ABAC vs ReBAC, authorization vendors, AuthZEN
Related on Start with Identity
- GlossaryAuthorization (AuthZ)
Authorization (AuthZ) is the decision to permit or deny an authenticated subject access to a resource or action, and the rights that result; NIST's glossary, ci
- GlossaryRBAC
Role-Based Access Control. Permissions are bundled into roles, users are assigned roles. Simple to understand and audit, but role explosion is a common failure
- GlossaryRow-Level Security (RLS)
Row-level security (RLS) is a database feature that decides which rows a query may read or change based on who is running it, enforced by the database itself ra
- RankingBest Authorization Tools: Top 5 Fine-Grained Authorization Engines
The top 5 authorization tools (Styra/OPA, AuthZed, OpenFGA, Cerbos, Permit.io), scored on a 10-dimension rubric, spanning policy-as-code and Zanzibar-style ReBA
- GuideAuthentication vs Authorization (AuthN vs AuthZ) Explained
The difference between authentication and authorization is the question each answers: **authentication (authn) verifies who you are, and authorization (authz) d
- StandardAuthZEN Authorization API
AuthZEN is the OpenID Foundation standard API between the code that enforces access (a PEP) and the engine that decides it (a PDP). One JSON request, subject pl