Modules
Standalone Ash Framework extension for Zanzibar / ReBAC authorization
backed by Licet (embedded Postgres/Ecto), SpiceDB / Authzed (HTTP via Req),
or AshAuthzed.Adapters.Memory (in-memory Licet engine).
Behaviour and unified dispatcher for ReBAC backends (Licet, SpiceDB HTTP, or Memory).
Adapter for evaluating permissions and storing relationship tuples using
an embedded Licet instance backed by Postgres / Ecto.
Caller-supervised in-memory Zanzibar / ReBAC adapter powered by Licet
and Licet.Schema.
Adapter for communicating with an external SpiceDB / Authzed server over HTTP/JSON via Req.
Ash.Policy.FilterCheck that evaluates whether the actor has a given Zanzibar permission
on the target resource(s) via AshAuthzed.Adapter.lookup_resources/4, or on a static target
object (target: "catalog:main" / on: "catalog:main") via AshAuthzed.Adapter.check?/4.
Ash.Policy.SimpleCheck that verifies whether the actor is permitted to assign
the new value of a given attribute on a target Zanzibar resource (e.g., platform:main).
Represents a conditional wildcard relation (object_type:id#name@subject_type:*)
written when attribute is in the specified list of values.
Exception raised or returned when an AshAuthzed operation fails.
Represents a role or capability attribute on the resource that maps to a relation
on the resource instance itself (:self, the default) or an external object
(e.g., target: "platform:main" -> platform:main#<role>@user:<id>).
Policy check macros automatically imported into Ash resources that use AshAuthzed.
Represents a direct Zanzibar relation between the resource and a subject.
Synchronizes Ash resource lifecycle changes to Zanzibar/ReBAC relationship tuples.
Compile-time Spark DSL transformer that
Compile-time Spark verifier that cross-checks an Ash resource's authzed DSL
and policies block against the .zed schema file.
Alias for AshAuthzed for compatibility with extensions: [AshRebac].
Mix Tasks
Streams existing Ash resources from the database and synchronizes their Zanzibar / ReBAC relationship tuples into Licet or SpiceDB.
Runs real-database (non-sandbox) or in-memory benchmarks and adapter parity checks for AshAuthzed across Licet, Memory, and SpiceDB (HTTP).
Installs and configures AshAuthzed in an Ash project.
Applies the .zed or YAML Zanzibar schema file to the active ReBAC adapter (Licet, SpiceDB, or Memory).