Fine-grained authorization
Roles cover the common cases. Real products also need rules such as "only from the office network", "only their own region's records" or "anyone the document was shared with". LumoAuth runs all three models behind one check endpoint that answers in under a millisecond.
Authorization written as if-statements becomes impossible to audit
Access rules scattered across controllers cannot be listed, tested or explained to an auditor. Changing them means a deploy. Agents make this worse: they need to be checked against the same rules as people.
How LumoAuth solves it
Roles, permissions and groups
Define permissions, bundle them into roles, assign roles to users and groups. Roles can inherit. Docs
Attribute rules (ABAC)
Conditions on the user, the resource, the time and the request. "Finance managers can approve invoices under 10,000 from the corporate network." Docs
Relationships (Zanzibar)
Store facts like "alice is editor of folder:q4" and "doc:report is in folder:q4". Checks follow the relationships, so sharing a folder shares its contents. Docs
Write rules in plain English
Type the rule. The AI drafts the policy, you review it in the editor and the tester proves it before it goes live. Docs
One check endpoint
POST a subject, an action and a resource. The answer comes back with the reason, in the standard AuthZEN format. Bulk checks cover list pages. Docs
Debug without redeploying
The permission tester shows the decision and every rule that fired for any user, action and resource. Docs
Setting it up
Start with roles
Most products need five roles and twenty permissions. Seed them from the portal.
Add conditions where roles are not enough
Write an attribute policy for the exceptions: time, network, ownership, amount.
Model sharing with relationships
Define namespaces for folders and documents, write tuples when users share things.
Call the check from your code
lumo.check({subject, action, resource}) in every SDK. Cache per request if you like.
Standards involved
Plain names on the left, the specification on the right. The full map is in the standards reference.
- Authorization API
- OpenID AuthZEN 1.0
- Relationship model
- Google Zanzibar paper
- Resource indicators
- RFC 8707
Which plan you need
Roles, permissions, groups and the check endpoint are on every plan. Attribute rules and relationship-based access are sold together as the Fine-grained authorization add-on ($99/month) on Pro and Business.
Documentation
Questions
How fast is a check?
Can agents be subject to the same rules?
How does this compare to OpenFGA or SpiceDB?
Ship passwordless sign-in this week. Put guardrails on your agents today.
The Developer plan is free for 10,000 monthly users and ten agents, with no card. Everything speaks open standards, so moving in or out is a config change.