Resources

Authorization Resource Center

Master authorization fundamentals with our guides, events, and more.

Featured Events

Featured Content

Blog

Ten Types of Authorization

Patterns to articulate the rich relationships in your applications.

Docs

Local Authorization: A Guide

How to manage authorization data locally.

Blog

Authorization for the Rest of Us

Demystifying Zanzibar-style access control.

Docs

Modeling Authorization Logic in Polar

A deep dive into policy design.

Sample Apps

Sample App

Google Drive-Style File Sharing

Build a secure file-sharing system.

Sample App

Fine-Grained Access Control in EMRs

Secure patient data in electronic medical records.

Sample App

The Hidden Complexity of CRM Authorization

Managing permissions in customer management.

Sample App

List Filtering with Authorization

Control access to data in Rails apps.

Learn the Terms

Article

Beyond RBAC: Modern Permission Management for Complex Apps

Learn how to implement flexible, low-latency authorization using RBAC, ABAC, and ReBAC.

Article

ABAC Patterns

Learn how to authorize users based on attributes like roles, tags, or visibility flags—using Oso Cloud to combine RBAC and ABAC in real app logic.

Article

Authorization as a Service

Learn how moving access checks to a dedicated service eliminates duplicated logic, speeds up deploys, and keeps permissions consistent across services.

Article

What is Fine-Grained Authorization?

Learn what FGA is, when to use it, and how Oso Cloud helps you model complex, precise access control across roles, relationships, and attributes.

Ecosystem

Article

What is OPA (Open Policy Agent)?

Learn what Open Policy Agent (OPA) is, how it uses Rego to enforce policies across systems, and how it compares to alternatives like Oso for application authorization.

Blog

OPA vs. Oso

Oso Cloud’s list filtering ensures LLMs only access data users are authorized to see.

Article

What is Google Zanzibar?

Learn what Google Zanzibar is, how it powers high-scale, low-latency authorization at Google, and why services like Oso Cloud offer a more accessible alternative.

Article

OpenFGA Alternatives

OpenFGA is powerful but complex. Oso Cloud is a simpler, flexible alternative—no data sync required, and logic is easier to write and maintain.

Authorization in Microservices

Article

Microservices Best Practices

Learn thirteen essential microservices best practices to build scalable, resilient systems without overwhelming complexity.

Article

Microservices Security

Learn nine essential microservices security best practices to help you build zero-trust, least-privilege systems that scale securely.

Article

Deployment Architecture and Patterns

Learn key microservices deployment strategies and how to manage their complexity in real-world systems.

Blog

Authorization in Microservices

Learn three patterns for microservices authorization and how to pick the right one for your app’s scale and complexity.

Authorization for AI

Blog

Build a Secure LLM Chatbot

Learn how to build secure LLM chatbots with RAG and role-based access controls to protect sensitive data.

Blog

O’Reilly SuperStream: RAG in Production

Learn how to secure RAG chatbots by enforcing access control directly in vector search queries.

Blog

Feature or Product?: Vector Databases

Vector search is becoming a feature of existing databases, not a standalone product category.

Blog

Hey Database, What am I Authorized to See?

Oso Cloud’s list filtering ensures LLMs only access data users are authorized to see.

Let's see some code.