---
title: "Warden"
tagline: "Authorization"
language: "Go"
license: "Apache-2.0"
since: "2026"
canonical: "https://xraph.com/work/warden"
---

# Warden

RBAC, ABAC and Zanzibar-style relation tuples behind one Check call. Precedence is fixed and stated up front, explicit deny beating allow beating default deny, so you can layer a role model, attribute conditions and a relationship graph without guessing which one wins.

## Install

```bash
go get github.com/xraph/warden
```

## What it is

Warden answers "are you allowed to do this?" across three authorization models behind one API: RBAC, ABAC and ReBAC.

## Three models, one Check

- **RBAC**: roles, permissions, role inheritance, resource-scoped assignments.
- **ABAC**: attribute-based policies with conditions: IP ranges, time windows, regex matches on resource attributes.
- **ReBAC**: Zanzibar-style relation tuples with BFS graph walking, for the "editors of a document's parent folder can edit the document" class of question.

Precedence is fixed and stated up front: explicit deny beats allow beats default deny. Most systems that support more than one model leave this implicit, and the result is that nobody can predict the outcome of a conflict without reading the implementation.

## Practicalities

All data is tenant-scoped via Forge scope or standalone context helpers. There is an in-memory LRU cache with TTL and per-tenant or per-subject invalidation, plugin hooks for audit logging and metrics, and a drop-in Forge extension with DI, routes and middleware.

> An authorization check is a function call. Making it a network call means every request now depends on a third service, and the cache you build to fix that will have an invalidation bug.

---

*Unpublished draft. Not peer reviewed and not submitted to a venue.*


## Anatomy

- **RBAC**: Roles and permissions for the common case.
- **ABAC**: Attribute rules where roles run out.
- **ReBAC**: Relationship checks for graph-shaped ownership.
- **Check**: One call. The model used is an implementation detail.

## Constraints and trade-offs

- (decision) Three models behind one Check. Callers should not have to know which one answered.
- (trade-off) One entry point makes the fast path harder to see. Explain output exists for that reason.