Platform · Shipped · new here
ReBAC fine-grained authorization (OpenFGA)
Relationship-based access control behind a swappable adapter: owner then editor then viewer + team memberships + share semantics, evaluated by OpenFGA in production. Durable tuple-sync via the outbox keeps the app DB and FGA consistent; RLS remains the last-line tenant guarantee (defense in depth).
- Cluster
- Platform
- Type
- service
- Status
- Shipped
- Used by
- people-analytics-toolbox
Maturity evidence
- Functioning
- OpenFGA engine live in prod 2026-07-01; a differential smoke passes 7/7 vs the in-memory reference against the live store. Tuple-sync + listObjects + HigherConsistency checks verified live (AUTHZ-B-2).
- Valuable
- Fine-grained sharing (view/edit/share across users + teams) that RBAC models badly. Engine-agnostic: managed to self-host is an env change.
- Understood
- docs/DECISIONS/2026-06-30-pat-authz-a-openfga-seam.md + 2026-07-01-pat-authz-b-openfga-live.md; src/lib/authz/ (contract + model + adapters).
- Integrated
- getAuthz() env-switch (in-memory reference ↔ OpenFGA); tuple-sync reuses the outbox. First enforcing consumer LIVE: user-owned shareable collections (/jobframe/my-collections) — create/share/unshare/view/edit each gated by getAuthz().check, proven 6/6 by the hermetic gate test (AUTHZ-B-2 feature).
How to use it
- Data
- src/lib/authz/
Other Platform capabilities
- Comp audit self-serve — CSV intake, free validate, commerce-gated watermarked run (HO-155)
- Gift pass — gifted ownership on the entitlement store (magic-link claim)
- JobFrame canonical Job Family × Focus × Level taxonomy + classifier
- SMB pay-system wizard — chocolate/vanilla over the pay-system catalog
- Support channel — portfolio-wide /support form → ticket store → operator email
- Ask-your-data — generalizable NL→rank→tier→cite spoke (HO-378)
- Diagnostic acquisition — next-best-ask over a live hypothesis set
- Executive-Priorities Elicitation Instruments (static catalog)
Capability detail sourced from the People Analytics Toolbox capability feed (source of truth), snapshot retrieved 2026-07-23.