Overview
Rolebook is a small, local-first authorization engine. It answers one question: may this subject perform this one action on this one resource, and why?
It evaluates a policy against facts your application supplies. It has no database, network, authentication-provider, framework, or UI dependency, and nothing in the request path leaves the process.
The model in one paragraph
Section titled “The model in one paragraph”A policy declares resources, their actions, and their parents, plus roles that each live at a scope (organization, workspace, project) and carry allow and deny rules. A subject carries no roles. Your application loads the subject’s scoped assignments for the request and passes the target as a trusted resource with its full ancestry. Rolebook validates everything, evaluates denies before allows across every applicable assignment, and returns a decision with a stable code, a reason, and an optional trace.
Where it sits
Section titled “Where it sits”| Layer | Answers |
|---|---|
| Identity provider | Who is the subject? |
| Your application | Which assignments and which resource are involved? |
| Rolebook | Is this action allowed, and why? |
Status
Section titled “Status”Version 4. Private preview: the package is not yet published to a public registry, and the license is not yet decided.
- Getting started: define a policy, bind, check.
- Policies, Subjects and assignments, Trusted resources.
- Decisions: codes,
enforce,explain. - Hono adapter and Sharing.