Warrant (now WorkOS FGA)

Overview

Warrant was a Zanzibar-inspired fine-grained authorization (FGA) service with an Apache-2.0 open-source core. WorkOS acquired it in 2024 (announced 2024-04-23), and Warrant no longer exists as a standalone product: warrant.dev now carries one line, "Warrant -> Now WorkOS FGA." What WorkOS sells today under the FGA name is a re-architected product, not hosted Warrant. The open-source Warrant repository is still public, not archived, and links to WorkOS, but its last tagged release is v1.15.1 from 2024-06-10, and its README says that version handles only "low-to-moderate throughput."

What WorkOS FGA is good at

Resource-scoped roles for B2B SaaS without a new modeling language. In WorkOS's December 2025 post, FGA "extends the straightforward RBAC model to support nested, resource-scoped permissions," with up to five layers of hierarchical resource types. The FGA docs describe the mechanics: you define resource types (for example workspace, project, app) in the dashboard, register resources with a parent, and assign a user or group a role on a specific resource. Permissions flow to child resources automatically. Access checks answer three questions (can this user do X on Y, which resources can this user reach, who can reach this resource), at a documented sub-50 ms p95 with strong consistency. Organization-scoped roles are embedded in AuthKit access tokens, so org-wide checks need no API call, and IdP group mapping works for org-level roles. Existing RBAC customers need no migration.

Where it falls short

It is no longer relationship-based access control (ReBAC) in the Zanzibar sense. WorkOS explicitly argues against syncing high-cardinality resources into an external system; instead, applications keep fine-grained data locally and register only stable parent resources. That is pragmatic, but it means sharing models such as per-document grants to arbitrary users are your application's job. Several pieces were still listed as coming soon when we checked: IdP role mapping to resource-scoped roles, per-user permission grants or exclusions, edge caches, and non-user subject types. The product only makes sense inside WorkOS, and the open-source engine has had no tagged release since June 2024, so do not plan production use on it.

Pricing

Not published separately. As of 2026-11-05 the WorkOS pricing page lists AuthKit, SSO, Directory Sync, Audit Logs, and other products but no FGA or RBAC line item; ask WorkOS sales.

Best for, and who should look elsewhere

Choose WorkOS FGA if you already use WorkOS for SSO and SCIM and your permission model is a hierarchy of tenant resources. If you need Zanzibar-style relationship tuples, use OpenFGA or AuthZed (see OpenFGA vs AuthZed vs Cerbos). For policy-as-code, compare Cerbos, Permit.io, or Styra OPA. The RBAC to ReBAC guide and best authorization tools help frame the choice.

Bottom line

Warrant is gone as a product. Its successor, WorkOS FGA, is a clean hierarchical RBAC extension for WorkOS customers, not a general-purpose ReBAC engine.