XRAPHCross
XRAPH/Work/Authorization
Go · since 2026

Warden

RBAC, ABAC and Zanzibar-style relation tuples behind one Check call. Precedence is fixed and stated up front, explicit deny beating allow beating default deny, so you can layer a role model, attribute conditions and a relationship graph without guessing which one wins.

Language
Go
Category
Authorization
Since
2026
Stars
1
In production
01+
Repository ↗Docs →
01

Highlights

3 claims
H.01
Fourmodels
RBAC, ABAC, ReBAC, PBAC

One engine covering roles, attributes, relations and time-bound policy, with one definition of what a subject is.

H.02
ADSL
Source-controlled topology

The whole authorisation model as .warden files, with one CLI to lint, apply, diff, format and export, idempotent and prune-aware.

H.03
Oneserver
Every editor

Syntax highlighting, completion, hover, go-to-definition, diagnostics and formatting in VS Code, Neovim and Helix.

02

In production

1 named · more on the way
01

GameFramework

Boldsofts

AuthorisationUses Warden for authorisation, with the policy topology held as .warden files under version control and applied from the binary at start.

2026Visit ↗
More adopters being confirmed

Shipping something on Warden? The list is only as complete as the people who tell me. Ask to be on it, or just say what got in your way.

Get listed →
03

What it does

9 entries

Authorisation written as files you can review, covering four models without four vocabularies.

03.1
DSL

The topology as source

RBAC, ABAC, ReBAC and PBAC declared in .warden files under version control. One CLI lints, applies, diffs, formats and exports, idempotently and aware of what to prune.

Idempotent
03.2
Tooling

One language server

Syntax highlighting, cross-file completion, hover, go-to-definition, diagnostics and formatting, reaching VS Code, Neovim and Helix from a single implementation.

LSP
03.3
RBAC

Hierarchical roles

Permissions, resource-scoped assignments and glob matching, with identifiers and timestamps filled in on create so the boilerplate is not yours to write.

Glob
03.4
ABAC

Conditions on context

Allow and deny policies over IP ranges, time windows, departments and any attribute on the context, with more than fifteen operators including CIDR membership and regex.

15+ operators
03.5
ReBAC

Zanzibar-style relations

Relation tuples traversed breadth-first with subject sets through group membership, a configurable maximum depth and cycle detection.

Zanzibar
03.6
PBAC

Time-bound, with obligations

Validity windows for incident freezes and scheduled grants, plus named side-effects such as audit-log and require-mfa emitted when a policy matches.

Obligations
03.7
Scoping

Tenants and namespaces

Hard tenant walls with a softer namespace hierarchy inside each one, inheriting from ancestors, isolated between siblings and empty by default at the global scope.

Nested
03.8
Deployment

Embedded in the binary

Applying over an embed.FS ships the .warden tree inside the binary, so production has no external files to lose.

go:embed
03.9
Storage

Four backends

Postgres, SQLite, MongoDB and in-memory behind one composite Store interface, picked by DSN, with migrations managed by Grove and round-trip tested.

By DSN
04

Anatomy

4 modules
01

RBAC

Roles and permissions for the common case.

02

ABAC

Attribute rules where roles run out.

03

ReBAC

Relationship checks for graph-shaped ownership.

04

Check

One call. The model used is an implementation detail.

05

Why it exists

Design notes

#What it is

Warden answers "are you allowed to do this?" across three authorization models behind one API: RBAC, ABAC and ReBAC.

#Three models, one Check

  • RBAC: roles, permissions, role inheritance, resource-scoped assignments.
  • ABAC: attribute-based policies with conditions: IP ranges, time windows, regex matches on resource attributes.
  • ReBAC: Zanzibar-style relation tuples with BFS graph walking, for the "editors of a document's parent folder can edit the document" class of question.

Precedence is fixed and stated up front: explicit deny beats allow beats default deny. Most systems that support more than one model leave this implicit, and the result is that nobody can predict the outcome of a conflict without reading the implementation.

#Practicalities

All data is tenant-scoped via Forge scope or standalone context helpers. There is an in-memory LRU cache with TTL and per-tenant or per-subject invalidation, plugin hooks for audit logging and metrics, and a drop-in Forge extension with DI, routes and middleware.

An authorization check is a function call. Making it a network call means every request now depends on a third service, and the cache you build to fix that will have an invalidation bug.
06

Signals

GitHub
Stars
1
Language
Go
Since
2026
Adopters
01
07

Where it sits

Fields · papers
Security & Identity
Adjacent systems
Authsome

Authentication for Go with every method as a plugin: password, social OAuth2, magic links, passkeys, TOTP and SMS second factors, API keys, SAML. Users, sessions, organizations, teams, RBAC and device tracking sit in the core; you compile in the methods you actually use. Ships with a dashboard.

Shield

Content safety arranged in layers that can short-circuit, roughly the way people react to danger. Instincts catch injection and exfiltration in under 10ms. Awareness spots PII, topic and intent. Boundaries are hard deny lists. Values apply toxicity and brand rules, and judgment scores grounding and compliance last, because it is the expensive one.

Vault

Secrets, feature flags and runtime config in one library. AES-256-GCM at rest with a new version archived on every write, flags with tenant, user, percentage-rollout and schedule targeting, and config entries that fire Watch callbacks when they change. Rotation runs in the background with a per-key callback.

Chronicle

An append-only audit log where every event carries the hash of the one before it, so an edit or a deletion breaks the chain and shows up in verification. Per-subject encryption means a GDPR erasure request destroys a key rather than a row, and the chain still verifies afterwards. Exports SOC 2, HIPAA and EU AI Act reports.

Got something
hard to build?

[email protected]↗
ElsewhereGitHub · /xraphGitHub · /juicycleffLinkedIn
FieldsAI & AgentsDigital TwinsDistributed SystemsSecurityLanguages & Tooling
MoreResearchWritingAboutDesign systemIdentityX-Files
Local time
--:--
Houston, TX