pgmorbacMulti-OrBAC for PostgreSQL
    DocumentationDownloadSource
    Use cases
    • How do I...?
    Getting Started
    • Introduction
    • Quick start
    • How pgmorbac compares
    • Upgrade
    Concepts
    • Organizations
    • Roles
    • Activities
    • Views
    • Contexts
    • Rules & Modalities
    • Global Rules
    • System Principals
    • Constraints
    • Row-Level Security
    • Decision Cache
    Resolution
    • is_allowed
    Recipes
    • Org Hierarchies
    • Multi-Tenant Isolation
    • Wildcard Admin
    • Delegation
    • Service Accounts
    • Deny Rules
    • Separation of Duty
    • Derived Roles
    • Cross-Org Access
    • Obligations & Recommendations
    • Temporal Access
    Integration
    • Fastify
    • PostgREST & RLS Context
    • SQL Only
    Reference
    • Function Reference

    Documentation

    Everything pgmorbac can express: the model, the decision algorithm, and a recipe for every access-control situation.

    Start readingBrowse use cases

    Have a situation in mind?

    The use-case catalogue answers "how do I..." questions directly: searchable, filterable by topic, and each entry lists the objects and SQL you need.

    Getting Started

    IntroductionWhat pgmorbac is and how Multi-OrBAC models access control.Quick startFrom empty database to an enforced permission in five minutes.How pgmorbac comparesRBAC, OrBAC, Multi-OrBAC, ABAC, PBAC, ReBAC: what each decides on and where this fits.UpgradeVersion stamps, upgrade scripts, and ALTER EXTENSION UPDATE.

    Concepts

    OrganizationsThe org tree, ancestors, descendants, and scope resolution.RolesOrg-scoped roles, role hierarchy, and effective role computation.ActivitiesGlobal action names and the activity hierarchy.ViewsGlobal resource categories and the view hierarchy.ContextsPredicate functions that decide when a rule applies.Rules & ModalitiesPermissions, prohibitions, obligations, recommendations, priorities.Global RulesWildcard rules that apply outside the organization tree.System PrincipalsTrigger-locked service accounts that skip prohibitions.ConstraintsSeparation of duty, cardinality, negative assignments, derived roles.Row-Level Securityrls_check, session context, and policy patterns.Decision CacheThe authorization cache, its TTL, and invalidation triggers.

    Resolution

    is_allowedThe full decision algorithm, step by step.

    Recipes

    Org HierarchiesSubtree-scoped rules that follow the organization tree.Multi-Tenant IsolationGuaranteeing sibling organizations cannot see each other.Wildcard AdminBootstrapping a safe global administrator.DelegationTime-bounded hand-over of a role to another user.Service AccountsSystem principals versus ordinary service users.Deny RulesProhibitions, priorities, and suspending access without deleting grants.Separation of DutyConflicting roles and role cardinality limits.Derived RolesCondition-based role membership evaluated at decision time.Cross-Org AccessGranting one organization's role access into another organization.Obligations & RecommendationsCompliance duties attached to permissions.Temporal AccessRules with validity windows and automatic expiry.

    Integration

    FastifyThe @crudy/pgmorbac plugin: hasPermission, org scopes, management routes.PostgREST & RLS ContextSession context injection for RLS-backed API access.SQL OnlyUsing pgmorbac from any stack with plain SQL calls.

    Reference

    Function ReferenceEvery morbac helper function alongside is_allowed: org traversal, roles, cache, audit, config.
    pgmorbac - Multi-OrBAC permission engine for PostgreSQL
    DocumentationDownloadGitea