Developer-friendly Access Control and Authorization

Implementing and maintaining user permissions and access control logic often becomes a tedious and complex endeavor for application developers due to several factors:

Increasing complexity with scale: As an application grows in size and functionality, the number of roles, permissions, and access rules tends to increase rapidly. This exponential growth makes it challenging to manage and maintain a coherent access control system.

Frequent policy changes: Business requirements and security policies evolve over time, necessitating frequent updates to access control logic. This constant need for modification can be time-consuming and error-prone.

Separation of concerns: Mixing access control logic with business logic in application code can lead to a cluttered, hard-to-maintain codebase. Separating these concerns often requires significant refactoring and architectural changes.

Fine-grained control requirements: Modern applications often require highly granular access controls, down to individual data fields or specific actions. Implementing such fine-grained permissions adds layers of complexity to the access control system.

Complicated additional syntax: Existing access control and authorization SDKs, frameworks or libraries often require to learn a new—often complicated—policy language.

Cross-application consistency: Maintaining consistent access control across multiple applications or microservices can be challenging, especially when each application has its own implementation.

Performance considerations: As access control checks become more complex and frequent, they can impact application performance, requiring careful optimization.

Auditing and compliance: Implementing comprehensive logging and auditing for access control decisions adds another layer of complexity, especially when dealing with regulatory requirements.

User experience balance: Developers must strike a balance between stringent security measures and a smooth user experience, which often requires intricate logic and careful design.

Dynamic permissions: Implementing systems that allow for runtime changes to permissions without code modifications requires sophisticated architectures and additional development effort.

Testing and validation: Thoroughly testing all possible permission combinations and edge cases becomes increasingly difficult as the complexity of the access control system grows.

All these factors collectively transform what might initially seem like an easy and straightforward task into a complex and ongoing challenge for developers, requiring significant time and resources to implement and maintain.

Years of experience developing software have given us a deep understanding of access control and authorization challenges—like the ones described above. We've examined existing solutions like permit.io, OSO, and Cerbos, but they often fell short: lacking features, being proprietary, or requiring complex integration.

To address these shortcomings, we created a comprehensive Software Development Kit (SDK) that simplifies access control. This SDK prioritizes ease of use and flexibility, allowing for fine-grained control over permissions. Access control policies, permissions, and rules are defined in JSON format, a common data format compatible with popular programming languages like TypeScript/JavaScript, PHP, Python, Ruby, Go, Java, .NET, and C++. This JSON approach makes the SDK familiar and easy to integrate for most developers.