Website | WorkOS FGA | Docs | API Reference

GitHub GitHub release (latest by date) GitHub Workflow Status (with branch)

# Warrant - Google Zanzibar-inspired, Fine-Grained Authorization Service Warrant is a **highly scalable, centralized, fine-grained authorization service** for _defining_, _storing_, _querying_, _checking_, and _auditing_ application authorization models and access rules. At its core, Warrant is a [relationship based access control (ReBAC)](https://en.wikipedia.org/wiki/Relationship-based_access_control) engine (inspired by [Google Zanzibar](https://research.google/pubs/pub48190/)) capable of enforcing any authorization paradigm, including role based access control (RBAC) (e.g. `[user:1] has [permission:view-billing-details]`), attribute based access control (ABAC) (e.g. `[user:1] can [view] [department:accounting] if [geo == "us"]`), and relationship based access control (ReBAC) (e.g. `[user:1] is an [editor] of [document:docA]`). It is especially useful for implementing fine-grained access control (FGAC) in internal and/or customer-facing applications. ## Features - HTTP APIs for managing your authorization model, access rules, and other Warrant resources (roles, permissions, features, tenants, users, etc.) from an application, a CLI tool, etc. - Real-time, low-latency API for performing access checks in your application(s) at runtime (e.g. `is [user:A] an [editor] of [tenant:X]?`) - Integrates with in-house and third-party authn/identity providers like Auth0, Firebase, and more - [SDKs](#sdks) for popular languages and frameworks (backend and frontend) - Support for a number of databases, including: MySQL, Postgres, and SQLite (in-memory or file) ## Use Cases Warrant is built specifically for application authorization and access control, particularly for product, security, and compliance use-cases. Examples of problems Warrant solves are: - Add role based access control (RBAC) to your SaaS application with the ability for your customers to self-manage their roles and permissions via the Warrant self-service dashboard or your own custom dashboard built using Warrant's component library. - Allow customers to define and manage their own roles & permissions for their tenant (organization) - Add 'fine-grained role-based access control' (role based access to specific resources) - Implement fine-grained, object/resource-level authorization specific to your application's data model (`[user:1] is an [editor] of [document:x]`) - Add centralized and auditable access control around your internal applications and tools. - Implement 'approval flows' (i.e. request access to a resource from an admin -> admin approves access). - Add Google Docs-like sharing and permissioning for your application's resources and objects. - Gate access to SaaS features based on your product's pricing tiers and feature packages. - Satisfy auditing and compliance requirements of frameworks and standards such as SOC2, HIPAA, GDPR and CCPA. ## Getting Started Check out the [development guide](/development.md) to learn how to run Warrant locally and refer to the [deployment examples](/deployment.md) for examples of self-hosting Warrant using Docker or Kubernetes. ## SDKs - [Node.js](https://github.com/warrant-dev/warrant-node) - [Go](https://github.com/warrant-dev/warrant-go) - [Python](https://github.com/warrant-dev/warrant-python) - [Ruby](https://github.com/warrant-dev/warrant-ruby) - [PHP](https://github.com/warrant-dev/warrant-php) - [Java](https://github.com/warrant-dev/warrant-java) - [React](https://github.com/warrant-dev/react-warrant-js) - [Angular](https://github.com/warrant-dev/angular-warrant) - [Vue](https://github.com/warrant-dev/vue-warrant) ## Limitations Serving check and query requests with low latency at high throughput requires running Warrant as a distributed service with the use of [Warrant-Tokens](https://workos.com/docs/fga/warrant-tokens) (also referred to as [Zookies](https://workos.com/blog/google-zanzibar-authorization#global-scale-low-latency) in Google Zanzibar). As a result, this open source version of Warrant is only capable of handling low-to-moderate throughput and is best suited for POCs, development/test environments, and low throughput use-cases. ## Contributing Contributions are welcome. Please see our [contributing guide](/CONTRIBUTING.md) for more details.