Permissions without
the if-statements.
Roles, scopes, conditions, attributes — typed end-to-end and evaluated at the edge in under 2 ms. One can() call replaces the spaghetti.
// resources, actions, conditions — typed end-to-end policy "projects.deploy" { resource = Project action = "deploy" allow if user.role in ["owner", "admin", "developer"] allow if resource.team in user.teams allow if user.attrs.level >= 4 deny if resource.archived == true deny if request.geo in org.blocked_geos deny if mfa.age > "5m" && resource.tier == "prod" }
Roles get you 80% there. Authaz handles the rest.
Pure RBAC breaks the moment your customer asks for 'admins, but only for their team.' Authaz lets you express that — and a hundred more — without rebuilding your authz.
Roles, scopes, attributes.
Start with roles. Add scopes (team, region, resource). Add attributes (level, FTE, employment type). Compose them; we evaluate them.
One can.enforce() call.
Edge-evaluated, sub-2 ms. Combines RBAC + ABAC + resource scopes against your typed policies. Returns allow / deny with the matching rule.
Decision + audit trail.
Typed allow / deny in your codebase. Every decision streams to your SIEM with the inputs, the matching policy, and the verdict — replay-able.
Roles you can see at a glance.
Every project starts here: a role × action grid that tells you exactly who can do what. Override per-tenant from the same UI.
Everything an authz model touches.
A scope is more than a tenant id.
Tenant, team, role, attributes, resource. Authaz threads all five through every decision so policies can branch on whatever the buyer cares about — geo, employment type, MFA freshness, anything.
- session-bound · forge-proof
- ABAC + RBAC, composable
- add a scope without a migration
Policies that read like English.
Define rules in our policy language — or in TypeScript next to your app. Both compile to the same engine. Both are diff-reviewable.
- versioned · diffable · rollback-able
- TypeScript or DSL, your call
- simulator runs every branch on real data
Every decision, traced and auditable.
Each can() emits an audit event with the inputs, the matching policy, and the verdict. Stream to Datadog, S3, or your SIEM.
- allow / deny / partial
- sub-2ms p99
- replay-able from the audit log
One call. Same shape, every endpoint.
The fine print, up front.
p50 0.7ms · p99 1.4ms · global edgeOne platform. Every primitive.
Every Authaz product shares the same primitives — sessions, policies, audit, tenants. Pick what you need today; add the rest when you do.
User Management
Profile lifecycle, sessions, and account controls in one place.
Admin & Dashboard Access
Authentication that works for back-office and internal tools.
Multi-tenant Organizations
Model organizations, members, and tenant boundaries cleanly.
Stop branching on user.role.
Roles, scopes, attributes — one call, sub-2 ms decisions, audited every time.