Casbin

Casbin is an open-source authorization library that provides access control models and policy management for software systems and services.

• Access control framework supporting multiple authorization models such as Access Control List (ACL), Role-Based Access Control (RBAC), and Attribute-Based Access Control (ABAC)
• Policy management and enforcement engine for applications, microservices, and APIs
• Multi-language libraries and integrations for embedding authorization into diverse technology stacks
• Administration tooling for managing authorization policies and model configurations
• Support for centralized authorization in distributed systems and cloud-native environments

More About Casbin

Casbin focuses on authorization and access control, providing a framework that enterprises and institutions can embed into their applications, APIs, and infrastructure services to manage permissions and enforcement logic in a consistent way. The project offers a policy-based access control model, where authorization decisions are driven by externalized rules rather than hard-coded logic inside application code. This enables centralized governance of who can access which resources, under what conditions, across a broad set of systems.

Casbin supports several common access control paradigms, including Access Control Lists (ACL), RBAC, and ABAC (identity and access management). These models are defined through a model configuration file, while permissions and rules are stored as policies, often in text files or backing data stores. At runtime, Casbin evaluates incoming requests against these models and policies to determine whether to allow or deny access. This approach is designed to keep authorization logic separate from business logic, while still allowing applications to call the Casbin enforcement APIs with request attributes such as subject, object, and action.

The Casbin ecosystem includes libraries for multiple programming languages (developer tools), which makes it applicable across heterogeneous enterprise environments. These language bindings enable integration with monolithic applications, microservices, and serverless components. Casbin is also used alongside Application Programming Interface (API) gateways, backend services, and custom business applications where fine-grained authorization is required, providing a consistent policy evaluation engine regardless of the underlying language or framework.

For policy storage and administration, Casbin can integrate with a range of data backends and management tools (security and access management). Policies can be stored in files, relational databases, or other persistence layers, which supports centralized management of access rules across large environments. Administrative interfaces and dashboards that connect to Casbin enable security and operations teams to inspect, update, and audit authorization policies without modifying application code.

From an architectural perspective, Casbin can be embedded as a library inside each service or exposed via a centralized authorization service that multiple applications query. This flexibility supports various deployment models used in enterprise environments, including cloud-native and containerized architectures. In a broader marketplace taxonomy, Casbin is categorized under authorization and policy-based access control (identity and access management), serving as a policy engine that organizations can adopt to implement and maintain consistent authorization rules across their digital services.