# ash_authzed v0.2.0 - Table of Contents

> Zanzibar-style Relationship-Based Access Control (ReBAC) extension for Ash Framework with SpiceDB and Licet adapters.

## Pages

- [Overview](readme.md)

- Tutorials
  - [Getting Started](getting-started-with-ash-authzed.md)

- DSL Reference
  - [DSL: AshAuthzed](dsl-ashauthzed.md)

- Reference
  - [Changelog](changelog.md)
  - [LLM & Agent Usage Rules](usage-rules.md)

## Modules

- Extension
  - [AshAuthzed](AshAuthzed.md): Standalone Ash Framework extension for Zanzibar / ReBAC authorization
backed by `Licet` (embedded Postgres/Ecto), `SpiceDB` / `Authzed` (HTTP via `Req`),
or `AshAuthzed.Adapters.Memory` (in-memory `Licet` engine).
  - [AshAuthzed.Checks.Can](AshAuthzed.Checks.Can.md): `Ash.Policy.FilterCheck` that evaluates whether the actor has a given Zanzibar permission
on the target resource(s) via `AshAuthzed.Adapter.lookup_resources/4`, or on a static target
object (`target: "catalog:main"` / `on: "catalog:main"`) via `AshAuthzed.Adapter.check?/4`.
  - [AshAuthzed.Checks.CanAssign](AshAuthzed.Checks.CanAssign.md): `Ash.Policy.SimpleCheck` that verifies whether the actor is permitted to assign
the new value of a given attribute on a target Zanzibar resource (e.g., `platform:main`).

  - [AshAuthzed.ConditionalWildcard](AshAuthzed.ConditionalWildcard.md): Represents a conditional wildcard relation (`object_type:id#name@subject_type:*`)
written when `attribute` is in the specified list of values.

  - [AshAuthzed.ExternalRole](AshAuthzed.ExternalRole.md): Represents a role or capability attribute on the resource that maps to a relation
on the resource instance itself (`:self`, the default) or an external object
(e.g., `target: "platform:main"` -> `platform:main#<role>@user:<id>`).

  - [AshAuthzed.PolicyMacros](AshAuthzed.PolicyMacros.md): Policy check macros automatically imported into Ash resources that use `AshAuthzed`.

  - [AshAuthzed.Relation](AshAuthzed.Relation.md): Represents a direct Zanzibar relation between the resource and a subject.

  - [AshAuthzed.SyncChange](AshAuthzed.SyncChange.md): Synchronizes Ash resource lifecycle changes to Zanzibar/ReBAC relationship tuples.
  - [AshRebac](AshRebac.md): Alias for `AshAuthzed` for compatibility with `extensions: [AshRebac]`.

- Adapters
  - [AshAuthzed.Adapter](AshAuthzed.Adapter.md): Behaviour and unified dispatcher for ReBAC backends (`Licet`, `SpiceDB` HTTP, or `Memory`).

  - [AshAuthzed.Adapters.Licet](AshAuthzed.Adapters.Licet.md): Adapter for evaluating permissions and storing relationship tuples using
an embedded `Licet` instance backed by Postgres / Ecto.
  - [AshAuthzed.Adapters.Memory](AshAuthzed.Adapters.Memory.md): Caller-supervised in-memory Zanzibar / ReBAC adapter powered by `Licet`
and `Licet.Schema`.
  - [AshAuthzed.Adapters.SpiceDBHttp](AshAuthzed.Adapters.SpiceDBHttp.md): Adapter for communicating with an external SpiceDB / Authzed server over HTTP/JSON via `Req`.

- Transformers &amp; Verifiers
  - [AshAuthzed.Transformer](AshAuthzed.Transformer.md): Compile-time Spark DSL transformer that:
- Derives `relation` entities and `policy` checks directly from the `.zed` schema
  when `from_zed` is configured on the resource.
- Attaches `AshAuthzed.SyncChange` to resource actions (`:create`, `:update`, `:destroy`).
- Registers `@external_resource` for the configured `.zed` / YAML schema file so changes
  trigger automatic recompilation.

  - [AshAuthzed.Verifiers.VerifyZedSchema](AshAuthzed.Verifiers.VerifyZedSchema.md): Compile-time Spark verifier that cross-checks an Ash resource's `authzed` DSL
and `policies` block against the `.zed` schema file.

- Errors
  - [AshAuthzed.Error](AshAuthzed.Error.md): Exception raised or returned when an `AshAuthzed` operation fails.

## Mix Tasks

- [mix ash_authzed.backfill](Mix.Tasks.AshAuthzed.Backfill.md): Streams existing Ash resources from the database and synchronizes their
Zanzibar / ReBAC relationship tuples into Licet or SpiceDB.
- [mix ash_authzed.bench](Mix.Tasks.AshAuthzed.Bench.md): Runs real-database (non-sandbox) or in-memory benchmarks and adapter parity checks
for AshAuthzed across Licet, Memory, and SpiceDB (HTTP).
- [mix ash_authzed.install](Mix.Tasks.AshAuthzed.Install.md): Installs and configures AshAuthzed in an Ash project.
- [mix ash_authzed.schema.apply](Mix.Tasks.AshAuthzed.Schema.Apply.md): Applies the `.zed` or YAML Zanzibar schema file to the active ReBAC adapter (`Licet`, `SpiceDB`, or `Memory`).