#What it is
Warden answers "are you allowed to do this?" across three authorization models behind one API: RBAC, ABAC and ReBAC.
#Three models, one Check
- RBAC: roles, permissions, role inheritance, resource-scoped assignments.
- ABAC: attribute-based policies with conditions: IP ranges, time windows, regex matches on resource attributes.
- ReBAC: Zanzibar-style relation tuples with BFS graph walking, for the "editors of a document's parent folder can edit the document" class of question.
Precedence is fixed and stated up front: explicit deny beats allow beats default deny. Most systems that support more than one model leave this implicit, and the result is that nobody can predict the outcome of a conflict without reading the implementation.
#Practicalities
All data is tenant-scoped via Forge scope or standalone context helpers. There is an in-memory LRU cache with TTL and per-tenant or per-subject invalidation, plugin hooks for audit logging and metrics, and a drop-in Forge extension with DI, routes and middleware.
An authorization check is a function call. Making it a network call means every request now depends on a third service, and the cache you build to fix that will have an invalidation bug.