What it does
OpenFGA is a fine-grained authorization engine inspired by Google Zanzibar. It stores relationship tuples and evaluates access against an authorization model, supporting relationship-based and role-based patterns.
Why it’s interesting
Permission inheritance becomes explicit in a model rather than scattered across handlers. Graph traversal and caching are worth studying, especially when reasoning about consistency and latency.
Real-world use case
Model users, teams, folders, and documents for a collaboration app. Before editing a document, have the backend check the user’s editor relationship.
What I can learn
- 01
ReBAC modeling
express inherited access and userset relationships.
- 02
Graph evaluation
resolve nested relations and short-circuit checks.
- 03
Service boundaries
centralize authorization while keeping authentication separate.
One thing to explore
Authorization commands and storage
Follow the implementation and connect it to the learning points above.
Explore the source (opens in a new tab)10-Minute Challenge
Try a relationship model in the playground
Before you start: Docker. This temporary in-memory setup does not persist data or configure production authentication.
- Start the disposable in-memory server below. Port 3001 avoids the usual Next.js development port.
- Open http://localhost:3001/playground and create a model with user and document types and a viewer relation.
- Write user:anne as viewer of document:readme, then compare checks for Anne and another user.
docker run --rm -p 127.0.0.1:8080:8080 -p 127.0.0.1:3001:3000 openfga/openfga run