Warden: Composable Authorization Engine

Warden is a composable permissions and authorization engine for Go. It answers the fundamental question: "Is this subject allowed to perform this action on this resource?"

Warden combines four authorization models into a unified engine:

• RBAC — Role-Based Access Control with hierarchical roles, permissions, and assignments
• ABAC — Attribute-Based Access Control with policy conditions (IP ranges, time windows, custom attributes)
• ReBAC — Relationship-Based Access Control (Zanzibar-style) with relation tuples and graph traversal
• PBAC — Policy-Based Access Control with time-bound windows and named obligations (audit-log, require-mfa, …)

Key Features

• Unified Check API — A single Check() call evaluates RBAC, ABAC, ReBAC, and PBAC together
• Decision Priority — Explicit deny always wins over allow, which wins over default deny
• Obligations — PBAC side-effect signals flow through CheckResult.Obligations and the PolicyObligationFired plugin hook
• Type-Safe IDs — TypeID-based identifiers for all entities (wrol_, wprm_, wasn_, wpol_, wrel_)
• Multi-Tenant + Namespaces — Every operation is scoped to a tenant; nested namespaces give cascading scope inheritance for org charts that aren't flat
• Pluggable Stores — Memory, PostgreSQL, SQLite, and MongoDB backends
• Plugin System — Lifecycle hooks for audit logging, metrics, and custom integrations
• Declarative DSL — .warden files for defining roles, permissions, policies, resource types, and relations as source-controlled config
• First-Class Tooling — warden CLI (lint, apply, diff, fmt, export, lsp), language server, and VS Code extension
• Forge Integration — First-class Forge extension with DI, middleware, and OpenAPI routes
• Standalone Mode — Use without Forge as a plain Go library

Quick Example

eng, _ := warden.NewEngine(
    warden.WithStore(memoryStore),
)

result, _ := eng.Check(ctx, &warden.CheckRequest{
    Subject:      warden.Subject{Kind: "user", ID: "user-42"},
    Action:       "read",
    ResourceType: "document",
    ResourceID:   "doc-123",
})

if result.Allowed {
    // Access granted
}

Next Steps