B2B CIAM · Fine-Grained Authorization
Who can do what, to which resource, right now
Tokens answer the coarse questions — which organization, which product, which plan. Questions like “can Bob edit this workspace?” need relationships. We add OpenFGA with a model that ties every grant to org membership and an active product license, and keep it in sync with Keycloak and the entitlement service.
- Org-scoped, license-gated model
- Check and list at request time
- Leavers lose access in one delete
Standards & integrations
- OpenFGA
- ReBAC
- Zanzibar-style model
- Conditions
- OpenID Connect
- Event bus
Overview
Relationships where roles run out
Role-based access covers the coarse layer: organization admin, billing admin, member. It can't say which of a thousand workspaces Bob can edit, filter a list to what he can see, or switch off a product's resources when its license expires. OpenFGA models those as relationships. We design the model so every resource permission requires the grant, membership of the owning organization and an active license — then keep it in sync as a projection of Keycloak and the entitlement service.
What we deliver
- OpenFGA authorization model with tests
- Tuple mapping for every fact and its owner
- Sync workers and nightly reconciliation
- API middleware for Check and ListObjects
- Self-hosted OpenFGA deployment or managed FGA setup
- Runbook for revocation and consistency
Capabilities
What Fine-Grained Authorization covers
Configured, tested and documented on upstream Keycloak — then handed over or operated by us.
An org-scoped model
Organizations, product licenses and resources are types; admins inherit membership, and org members can be granted access as a group.
License-gated products
One license object per organization and product carries an expiry condition, so resources go dark when a license lapses without deleting anything.
Defense in depth
Every resource permission intersects the direct grant with org membership and an active license, so a mistaken cross-org grant still fails.
Check and list
APIs call Check for single decisions and ListObjects, with pagination, for filtered lists.
Sync as a projection
Membership and license tuples are written by one sync worker from Keycloak and entitlement events, with nightly reconciliation and drift alerts.
Tested, versioned model
The authorization model is versioned and covered by OpenFGA model tests, reviewed like any other code.
Tuples
From facts to relationships
Every relationship has one owner and reaches OpenFGA through one path.
| Fact | Source of truth | Relationship in OpenFGA |
|---|---|---|
| Alice is Acme's org admin | Org admin portal | user:alice admin organization:acme |
| Bob is an Acme member | Keycloak organization membership | user:bob member organization:acme |
| Acme is licensed for Product A until March | Entitlement service | organization:acme org product_license:acme_A, with an expiry condition |
| Bob holds a Product A seat | Entitlement service | user:bob product_user product_license:acme_A |
| All Acme members may use Product B | Entitlement service | organization:acme#member product_user product_license:acme_B |
| Workspace 1042 belongs to Acme and Product A | Product API on create | organization:acme org workspace:ws_1042, plus a license link |
| Bob created workspace 1042 | Product API on create | user:bob owner workspace:ws_1042 |
How it works
From first call to production
Design the model
We model organizations, licenses and your resource types, and write tests for every rule before any tuples exist.
Build sync and enforcement
Sync workers, reconciliation and API middleware for Check and ListObjects are built and load-tested.
Roll out product by product
Products adopt FGA checks one at a time, running in shadow mode before enforcement.
Use cases
Where teams put it to work
Collaboration features
Workspaces, projects and reports shared with individual people or whole organizations.
Users in several organizations
Consultants and partners who belong to several organizations never carry access from one into another.
Expiring licenses
A product's resources stop being usable the moment its term license expires.
FAQ
Fine-Grained Authorization questions, answered
Does OpenFGA replace the entitlement service?
No. OpenFGA decides whether a license is usable and what a user can do to a resource. It can't count seats, hold plans and features, or keep commercial history — that stays in the entitlement service.
Should we call OpenFGA during login?
Usually not. The entitlement service already answers whether an organization can use a product, and adding FGA calls to every login only adds latency. FGA belongs in the APIs.
What if we don't need resource-level sharing yet?
Start without it. Organization context, entitlements and coarse roles are enough, and OpenFGA can be introduced later without changing tokens.
Ready to roll out Fine-Grained Authorization?
Walk us through your requirements on a free strategy call. We'll come back with an architecture, a delivery plan and a fixed scope.