Documentation

agentauthz is an agent-native, embeddable TypeScript authorization engine. Policies are rows in your own database, written at runtime through an API or an admin UI, not files compiled into a deployment.

Where to start

Getting started

Install, declare a vocabulary, make your first check

Architecture

The layers, the ports, and why the engine owns storage

Comparison

What ships complete here vs Cedar, Zanzibar services, Casbin

Semantics

Statements, deny-wins, scope chains, fail-closed conditions

Conditions

The typed operator whitelist and its two traps

Grants & bounds

One curated policy, different limits per subject

Admin surface

describe(), the descriptor document, and the HTTP handlers

Building a UI

Generate every admin screen from the descriptor

MCP server

Agent-facing tools whose schemas come from your vocabulary

Cookbook

A runnable host with a working admin UI, recipe by recipe

Storage & conformance

The pg backend, migrations, and the backend-flip contract

The shape of it

Architecture: your app calls check() and the admin handlers; both cross the ports seam; Postgres is the plugged-in reference backend and any conformant backend drops into the open socket

The host keeps, permanently: authentication and subject resolution, the admin-bypass decision, HTTP routing, the action vocabulary, and what the admin UI looks like. The library owns the decision semantics, validation, storage, and audit.