explaingit

apache/casbin

📈 Trending★ 20,118GoAudience · developerComplexity · 3/5ActiveLicenseSetup · easy

TLDR

Authorization library that decides who can do what on which resources. Supports ACL, RBAC, ABAC patterns without writing permission logic from scratch.

Mindmap

mindmap
  root((Casbin))
    What it does
      Access control decisions
      Permission enforcement
      Multi-pattern support
    Patterns supported
      ACL simple lists
      RBAC role-based
      ABAC attribute-based
      Combined patterns
    How it works
      Config file model
      Policy file storage
      Online editor
      Code-free updates
    Use cases
      Multi-user apps
      API permission levels
      SaaS tenants
      Firewall-like rules
    Tech stack
      Go primary
      Java port
      Node.js port
      Python port
    Audience
      Backend developers
      API designers
      SaaS builders

Things people build with this

USE CASE 1

Build a multi-user web app where admins, editors, and viewers have different permissions on documents.

USE CASE 2

Add fine-grained access control to a REST API so users can only access their own data or shared resources.

USE CASE 3

Implement tenant isolation in a SaaS product where each customer's roles and permissions are separate.

USE CASE 4

Create firewall-like deny-override rules where certain actions are blocked regardless of other permissions.

Tech stack

GoJavaNode.jsPythonPHP.NETC++Rust

Getting it running

Difficulty · easy Time to first run · 5min
Use freely for any purpose, including commercial use, as long as you keep the copyright notice and license text.

In plain English

Casbin is an open-source authorization library that handles the question "is this user allowed to do this action on this resource?" It supports several well-established access control patterns and lets you choose and configure the one that fits your application, without writing the permission logic from scratch. The three main patterns it supports are ACL (Access Control List, a simple list of who can do what), RBAC (Role-Based Access Control, users are assigned roles like "admin" or "editor," and roles define permissions), and ABAC (Attribute-Based Access Control, permissions depend on properties of the user, resource, or environment). These can also be combined: for example, RBAC roles with domain-specific permissions for multi-tenant applications, or deny-override rules like firewall policies. The way Casbin works is through a configuration file that defines the access control model, and a separate policy file or database that stores the actual rules. Because the model is separate from the code, you can change your authorization scheme by editing a config file rather than rewriting application code. An online editor at casbin.org helps you write and test policies without running code. Casbin is primarily written in Go, but the same library is available in production-ready ports for Java, Node.js, PHP, Python.NET, C++, and Rust, all following the same concepts. You would use Casbin when building any application that needs fine-grained access control, such as a multi-user web service, an API with different permission levels, or a SaaS product with tenant-specific roles. It does not handle authentication (verifying who a user is), only authorization (deciding what they are allowed to do).

Copy-paste prompts

Prompt 1
How do I set up Casbin to enforce role-based access control (RBAC) in my Go application? Show me a simple example with admin and user roles.
Prompt 2
I need to add attribute-based access control (ABAC) to my API so permissions depend on user properties and resource attributes. How does Casbin handle this?
Prompt 3
Can I use Casbin to manage permissions for a multi-tenant SaaS app where each customer has their own roles? What's the recommended approach?
Prompt 4
I want to test my authorization policies before deploying. Does Casbin have a way to validate rules without running my application?
Prompt 5
How do I switch from a simple ACL to RBAC in Casbin without changing my application code?
Open on GitHub → Explain another repo

Generated 2026-05-18 · Model: sonnet-4-6 · Verify against the repo before relying on details.