{"docsConfig":{"theme":"luma","$schema":"https://mintlify.com/docs.json","name":"OpenFGA","description":"OpenFGA is a CNCF open source authorization system for fine-grained, relationship-based access control.","colors":{"primary":"#2c7a3f","light":"#d3ffd7","dark":"#558f69"},"logo":{"light":"https://raw.githubusercontent.com/openfga/community/22a5668e729b2d5453c6520e6f00c44a99fcd4fc/brand-assets/horizontal/color/black/openfga-horizontal-color_black.svg","dark":"https://raw.githubusercontent.com/openfga/community/22a5668e729b2d5453c6520e6f00c44a99fcd4fc/brand-assets/horizontal/color/white/openfga-horizontal-color_white.svg","href":"https://openfga.dev/"},"favicon":"https://mintcdn.com/fga/sFng5HcsvGPlDD3_/images/img/openfga-icon.svg?fit=max\u0026auto=format\u0026n=sFng5HcsvGPlDD3_\u0026q=85\u0026s=d48e6cd909aa0ce0d65f5dfe9085195d","api":{"playground":{"display":"simple"}},"appearance":{"default":"dark","strict":false},"background":{"color":{"dark":"#272b33"}},"navbar":{"links":[{"href":"/","label":"Docs"},{"href":"/api/service","label":"API Reference"},{"href":"https://openfga.dev/project","label":"Project"},{"href":"https://openfga.dev/community","label":"Community"},{"href":"https://openfga.dev/blog","label":"Blog"},{"href":"https://github.com/openfga/openfga","type":"github"}]},"footer":{"socials":{"x":"https://x.com/openfga","github":"https://github.com/openfga","linkedin":"https://www.linkedin.com/company/openfga","youtube":"https://www.youtube.com/@OpenFGA"}},"search":{"prompt":"Ask about OpenFGA"},"seo":{"metatags":{"canonical":"https://openfga.dev/docs","og:image":"https://openfga.dev/img/og-rich-embed.png","openfga:docs-source-sha256":"52615f566a33686f79387449f56e96ba38f4e369d945db11dcc3be3d69b9b373"},"indexing":"all"},"styling":{"codeblocks":"system","latex":false},"contextual":{"options":["copy","chatgpt","claude","add-mcp","cursor","vscode"],"display":"header"},"metadata":{"timestamp":true},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"fga","hasAudioNarration":false,"actualSubdomain":"fga","customDomains":["openfga.dev"],"gitSource":{"type":"github","owner":"openfga","repo":"openfga.dev","deployBranch":"docs-next","contentDirectory":"docs-site","isPrivate":false,"mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6aba7c6a1d55b415c961eedb","collectionId":"f7d0c1ac-0b54-488f-8408-ed8af8fd6ab8","schemaVersion":"v3","latestBuiltDeploymentHistoryId":"6aba7c6a1d55b415c961eedb"},"feedback":{"edits":true,"issues":true,"thumbs":true},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6ac3cb45308778e6590b59dc","clientVersion":"0.0.3971","searchFilterCounts":[{"language":"default","tag":"Docs","count":110},{"language":"default","tag":"Modeling Guides","count":31},{"language":"default","tag":"API Reference","count":24},{"language":"default","tag":"Getting Started","count":22},{"language":"default","tag":"Interacting with the API","count":11},{"language":"default","tag":"Adopters","count":9},{"language":"default","tag":"Setup OpenFGA","count":8},{"language":"default","tag":"Industries","count":8},{"language":"default","tag":"Best Practices","count":7},{"language":"default","tag":"Learn","count":7}]},"assistantConfig":{},"basePath":"/docs","hasChatPermissions":true,"hasWebMcpPermissions":true,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-v7-file-tree","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"pause-universal-search-reconcile","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"per-site-search-delta","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-private-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-nav-generations","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"byok-sep-25","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"vite-origin","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-agent-model-picker","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-updated-9-15","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"isAtlas":false,"googleFontsInlined":false},"customCss":[{"filePath":"global.css","content":"@media (min-width:1024px){:root{--openfga-reader-width:100rem}#sidebar-content{width:16rem!important;left:max(0px,calc((100% - var(--assistant-sheet-width, 0px) - var(--openfga-reader-width))/2))}#body-content{max-width:var(--openfga-reader-width);margin-inline:auto;padding-left:16rem!important}#navbar>div:has(.topbar-right-container){max-width:var(--openfga-reader-width);margin-inline:auto}#content-container:not(:has(>[data-api-example])) #content-area{max-width:48rem;margin-inline:auto}}#content-container:has(>[data-api-example]) #content-area{margin-inline:auto}#navbar a[href='https://openfga.dev/'] img{width:6.3125rem;height:1.5rem;object-fit:contain}@media (min-width:1024px){#navbar div:has(>.topbar-right-container)>div:has(>a[href='https://openfga.dev/']){flex:0 0 auto}#navbar .topbar-right-container{min-width:0}#navbar .topbar-right-container>ul{flex:1}#navbar .topbar-right-container>ul>li:has(>a[href='https://github.com/openfga/openfga']){margin-left:auto}}@media (max-width:1023px){#navbar div:has(>.topbar-right-container){display:flex;position:absolute;top:0;right:1rem;width:2.25rem;padding:0}#navbar .topbar-right-container>div:has(>#search-bar-entry),#navbar .topbar-right-container>div:has(>button[aria-label='More actions']),#navbar .topbar-right-container>ul,#navbar div:has(>.topbar-right-container)>div:has(>a[href='https://openfga.dev/']){display:none}#navbar div:has(>#search-bar-entry-mobile){padding-right:3rem}}@layer utilities{@media (min-width:1100px){#navbar #search-bar-entry{width:clamp(9.25rem,16vw,16rem)!important;padding-inline:.875rem!important;justify-content:space-between!important}#navbar #search-bar-entry .truncate{display:block}#navbar #search-bar-entry>span{display:inline-flex}}}#navbar :is(\n a:is([href='/'], [href='/docs'], [href='/docs/']),\n a:is([href='/api/service'], [href='/docs/api/service']),\n a[href='https://openfga.dev/project'],\n a[href='https://openfga.dev/community'],\n a[href='https://openfga.dev/blog']\n ){position:relative;isolation:isolate;min-height:2.75rem;padding-inline:.75rem!important;background:0 0!important;border:0!important;border-radius:9999px!important;text-decoration:none!important}#navbar :is(\n a:is([href='/'], [href='/docs'], [href='/docs/']),\n a:is([href='/api/service'], [href='/docs/api/service']),\n a[href='https://openfga.dev/project'],\n a[href='https://openfga.dev/community'],\n a[href='https://openfga.dev/blog']\n )::before{position:absolute;inset:.25rem 0;z-index:-1;content:'';background-color:transparent;border-radius:9999px;transition:background-color 150ms ease}#navbar :is(\n a:is([href='/'], [href='/docs'], [href='/docs/']),\n a:is([href='/api/service'], [href='/docs/api/service']),\n a[href='https://openfga.dev/project'],\n a[href='https://openfga.dev/community'],\n a[href='https://openfga.dev/blog']\n ):is(:hover, :focus-visible)::before{background-color:rgb(0 0 0/5%)}#navbar :is(\n a:is([href='/'], [href='/docs'], [href='/docs/']),\n a:is([href='/api/service'], [href='/docs/api/service']),\n a[href='https://openfga.dev/project'],\n a[href='https://openfga.dev/community'],\n a[href='https://openfga.dev/blog']\n ):is(:hover, :focus-visible){color:#1f2328!important}.dark #navbar :is(\n a:is([href='/'], [href='/docs'], [href='/docs/']),\n a:is([href='/api/service'], [href='/docs/api/service']),\n a[href='https://openfga.dev/project'],\n a[href='https://openfga.dev/community'],\n a[href='https://openfga.dev/blog']\n ):is(:hover, :focus-visible)::before{background-color:rgb(255 255 255/8%)}#navbar :is(\n a:is([href='/'], [href='/docs'], [href='/docs/']),\n a:is([href='/api/service'], [href='/docs/api/service']),\n a[href='https://openfga.dev/project'],\n a[href='https://openfga.dev/community'],\n a[href='https://openfga.dev/blog']\n ):focus-visible{outline:0}#navbar :is(\n a:is([href='/'], [href='/docs'], [href='/docs/']),\n a:is([href='/api/service'], [href='/docs/api/service']),\n a[href='https://openfga.dev/project'],\n a[href='https://openfga.dev/community'],\n a[href='https://openfga.dev/blog']\n ):focus-visible::before{box-shadow:0 0 0 2px rgb(var(--primary))}.dark #navbar :is(\n a:is([href='/'], [href='/docs'], [href='/docs/']),\n a:is([href='/api/service'], [href='/docs/api/service']),\n a[href='https://openfga.dev/project'],\n a[href='https://openfga.dev/community'],\n a[href='https://openfga.dev/blog']\n ):focus-visible::before{box-shadow:0 0 0 2px rgb(var(--primary-light))}.dark #navbar :is(\n a:is([href='/'], [href='/docs'], [href='/docs/']),\n a:is([href='/api/service'], [href='/docs/api/service']),\n a[href='https://openfga.dev/project'],\n a[href='https://openfga.dev/community'],\n a[href='https://openfga.dev/blog']\n ):is(:hover, :focus-visible){color:#f0f6fc!important}body:has(#api-playground-2-operation-page) #navbar a:is([href='/api/service'], [href='/docs/api/service']),body:not(:has(#api-playground-2-operation-page)) #navbar a:is([href='/'], [href='/docs'], [href='/docs/']){color:rgb(var(--primary))!important;font-weight:600}body:has(#api-playground-2-operation-page) #navbar a:is([href='/api/service'], [href='/docs/api/service'])::before,body:not(:has(#api-playground-2-operation-page)) #navbar a:is([href='/'], [href='/docs'], [href='/docs/'])::before{background-color:rgb(var(--primary)/10%)}.dark body:has(#api-playground-2-operation-page) #navbar a:is([href='/api/service'], [href='/docs/api/service']),.dark body:not(:has(#api-playground-2-operation-page)) #navbar a:is([href='/'], [href='/docs'], [href='/docs/']){color:rgb(var(--primary-light))!important}.dark body:has(#api-playground-2-operation-page) #navbar a:is([href='/api/service'], [href='/docs/api/service'])::before,.dark body:not(:has(#api-playground-2-operation-page)) #navbar a:is([href='/'], [href='/docs'], [href='/docs/'])::before{background-color:rgb(var(--primary-light)/12%)}.sidebar-group-header{text-transform:none}body:not(:has(#api-playground-2-operation-page)) #header .prose{display:none}.feedback-toolbar a[href^='https://github.com/openfga/']{min-height:3rem;gap:.375rem;padding:.25rem 0;border:0;border-radius:0;background:0 0;color:rgb(var(--primary));font-size:1rem;font-weight:400;line-height:1.65;text-decoration:none}.dark .feedback-toolbar a[href^='https://github.com/openfga/']{color:rgb(var(--primary-light))}.feedback-toolbar a[href^='https://github.com/openfga/']:hover{text-decoration:underline}.feedback-toolbar a[href^='https://github.com/openfga/']:focus-visible{outline:2px solid currentColor;outline-offset:4px;text-decoration:underline}.feedback-toolbar a[href^='https://github.com/openfga/'] small{font-size:inherit;line-height:inherit}.feedback-toolbar a[href^='https://github.com/openfga/'] svg{width:1.25rem;height:1.25rem;color:inherit}#footer div:has(>button[data-testid=mode-switch-system]),body:has(#api-playground-2-operation-page) .feedback-toolbar a[href^='https://github.com/openfga/openfga.dev/edit/'][href*='/docs-site/api/service/']{display:none}#ask-assistant-code-block-button,#assistant-entry,#assistant-entry-mobile,[data-assistant-bar],button[data-chat-payload-element-id]{display:none}#content .openfga-modeling-example{margin:2rem 0;padding:2rem;border-radius:1.5rem;background-color:#ebedf0;color:#1c1e21;font-family:'Inter',sans-serif}.dark #content .openfga-modeling-example{background-color:#444950;color:#e3e3e3}#content .openfga-modeling-example :is(ul, li, p, [data-as='p']){margin-block:0;font-size:14px;line-height:20px;letter-spacing:1.5px}#content .openfga-modeling-example ul{padding-left:2rem}#content .openfga-modeling-example hr{margin:1.5rem 0}#content .openfga-modeling-highlight{padding:1.2px 7.2px;border-radius:2.4px;font-family:'Inter',sans-serif;font-style:normal;font-weight:600;font-size:12px;line-height:18px;letter-spacing:.8px;text-transform:uppercase}a[href='https://github.com/openfga/openfga']>span:first-of-type{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}.openfga-github-stars-fallback{display:inline-flex;align-items:center;gap:.375rem;margin-left:.25rem;flex-shrink:0}.openfga-github-stars-fallback__count{line-height:1rem}.openfga-github-stars-fallback__icon{width:.875rem;height:.875rem;background-color:currentColor;-webkit-mask:url(https://d3gk2c5xim1je2.cloudfront.net/fontawesome/v7.2.0/regular/star.svg) center/contain no-repeat;mask:url(https://d3gk2c5xim1je2.cloudfront.net/fontawesome/v7.2.0/regular/star.svg) center/contain no-repeat}.dark .shiki,.dark .shiki span{background-color:var(--shiki-dark-bg)!important;color:var(--shiki-dark)!important;font-style:var(--shiki-dark-font-style)!important;font-weight:var(--shiki-dark-font-weight)!important;text-decoration:var(--shiki-dark-text-decoration)!important}:root{--openfga-tabs-surface:#ffffff;--openfga-tabs-border:#d0d7de;--openfga-tabs-active:#1f2328;--openfga-tabs-inactive:#59636e;--openfga-tabs-accent:#1a7f37}.dark{--openfga-tabs-surface:#1c1e22;--openfga-tabs-border:#3a3d44;--openfga-tabs-active:#ffffff;--openfga-tabs-inactive:#a7b0bc;--openfga-tabs-accent:#79ed83}.openfga-code-viewer{--openfga-code-surface:#f6f8fa;--openfga-code-header:var(--openfga-tabs-surface);--openfga-code-border:var(--openfga-tabs-border);--openfga-code-default:#1f2328;--openfga-code-muted:#59636e;--openfga-code-keyword:#57606a;--openfga-code-type:#1a7f37;--openfga-code-relation:#0969da;--openfga-code-directly-assignable:#8250df;--openfga-code-error:#cf222e;--openfga-code-accent:#1a7f37;--openfga-json-key:#0969da;--openfga-json-string:#953800;--openfga-json-number:#0550ae;--openfga-json-keyword:#8250df;--openfga-json-punctuation:#57606a;overflow:hidden;color:var(--openfga-code-default);background:var(--openfga-code-surface);border:1px solid var(--openfga-code-border);border-radius:.5rem}.dark .openfga-code-viewer{--openfga-code-surface:var(--openfga-dark-background, #0b0c0e);--openfga-code-default:var(--openfga-dark-default, #ffffff);--openfga-code-muted:var(--openfga-tabs-inactive);--openfga-code-error:#ff7b72;--openfga-code-accent:var(--openfga-dark-accent, var(--openfga-tabs-accent));--openfga-json-key:#9cdcfe;--openfga-json-string:#ce9178;--openfga-json-number:#b5cea8;--openfga-json-keyword:#569cd6;--openfga-json-punctuation:#d4d4d4}.openfga-code-viewer__tabs{display:flex;background:var(--openfga-code-header);border-bottom:1px solid var(--openfga-code-border)}.openfga-code-viewer__tab{padding:.4rem 1rem;color:var(--openfga-code-muted);font-size:.85rem;font-weight:400;cursor:pointer;background:0 0;border:0;border-bottom:2px solid transparent}.openfga-code-viewer__tab[data-state=active]{color:var(--openfga-code-default);font-weight:600;border-bottom-color:var(--openfga-code-accent)}.openfga-code-viewer__tab:focus-visible{outline:2px solid var(--openfga-code-accent);outline-offset:-3px}.openfga-code-viewer__title{padding:.5rem 1rem;color:var(--openfga-code-muted);font-size:.8rem;background:var(--openfga-code-header);border-bottom:1px solid var(--openfga-code-border)}.openfga-code-viewer__status{padding:1rem;color:#59636e;background:0 0;border:0}.dark .openfga-code-viewer__status{color:#a7b0bc;background:0 0}.openfga-code-viewer__code{padding:1rem;margin:0;overflow-x:auto;color:var(--openfga-code-default);font-family:var(--font-mono, ui-monospace, monospace);font-size:.875rem;line-height:1.6;white-space:pre;background:var(--openfga-code-surface)}.openfga-code-token[data-token=comment]{color:var(--openfga-code-muted)}.openfga-code-token[data-token=condition-param-type],.openfga-code-token[data-token=keyword]{color:var(--openfga-code-keyword)}.openfga-code-token[data-token=condition],.openfga-code-token[data-token=extend],.openfga-code-token[data-token=module],.openfga-code-token[data-token=type]{color:var(--openfga-code-type)}.openfga-code-token[data-token=condition-param],.openfga-code-token[data-token=relation]{color:var(--openfga-code-relation)}.openfga-code-token[data-token=directly-assignable]{color:var(--openfga-code-directly-assignable)}.openfga-code-token[data-token=error]{color:var(--openfga-code-error)}.openfga-code-token[data-token=json-key]{color:var(--openfga-json-key)}.openfga-code-token[data-token=json-string]{color:var(--openfga-json-string)}.openfga-code-token[data-token=json-number]{color:var(--openfga-json-number)}.openfga-code-token[data-token=json-keyword]{color:var(--openfga-json-keyword)}.openfga-code-token[data-token=json-punctuation]{color:var(--openfga-json-punctuation)}.dark .openfga-code-viewer__code[data-language=dsl] .openfga-code-token:not([data-token=error]){color:var(--openfga-dark-token-color, var(--openfga-code-default, #ffffff))}"}],"page":{"pagePath":"best-practices/overview","slug":"/best-practices/overview","pageMetadata":{"title":"OpenFGA Best Practices","description":"Overview of best practices when adopting OpenFGA","sidebarTitle":"Best Practices","href":"/best-practices/overview","hidden":true},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Overview of best practices when adopting OpenFGA\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){const _components={p:`p`,..._provideComponents(),...props.components},{Card,CardGroup}=_components;if(!Card)_missingMdxReference(`Card`,true);if(!CardGroup)_missingMdxReference(`CardGroup`,true);return _jsxs(_Fragment,{children:[_jsx(_components.p,{children:`This section contains a collection of best practices when implementing OpenFGA.`}),`\n`,_jsxs(CardGroup,{children:[_jsx(Card,{title:`Running OpenFGA in Production`,href:`/best-practices/running-in-production`,children:_jsx(_components.p,{children:`Learn about best practices for running OpenFGA in production environments.`})}),_jsx(Card,{title:`Adoption Patterns`,href:`/best-practices/adoption-patterns`,children:_jsx(_components.p,{children:`Learn the best ways to introduce OpenFGA in your project.`})})]})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"codeStyling":"system","config":{},"pageMetadata":{"title":"OpenFGA Best Practices","description":"Overview of best practices when adopting OpenFGA","sidebarTitle":"Best Practices","href":"/best-practices/overview","hidden":true}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":["/docs/_mintlify/custom/fga/32b0a86692356b07/fga-codegen.js","/docs/_mintlify/custom/fga/16b8063137d7a263/openfga-dsl-highlight.js","/docs/_mintlify/custom/fga/9e516ad2628a4a37/github-star-cache.js","/docs/_mintlify/custom/fga/8f4f15cdd920fede/openfga-viewer.js","/docs/_mintlify/custom/fga/7e280f50d6626695/navbar-layout.js"],"subdomain":"fga","siteName":"OpenFGA","title":"OpenFGA Best Practices - OpenFGA","relatedPagesConfig":{"enabled":false,"limit":5,"mode":"automatic"},"navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-09-28T05:29:43.849Z","gitLastModified":"2026-09-28T08:14:37.000Z","originalFileLocation":"best-practices/overview.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"dark\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Overview of best practices when adopting OpenFGA\">\u003cmeta data-mint-head name=\"application-name\" content=\"OpenFGA\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/docs/mintlify-assets/_mintlify/favicons/fga/Ogp9xKErjLVZVaSB/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/docs/mintlify-assets/_mintlify/favicons/fga/Ogp9xKErjLVZVaSB/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/docs/mintlify-assets/_mintlify/favicons/fga/Ogp9xKErjLVZVaSB/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/docs/mintlify-assets/_mintlify/favicons/fga/Ogp9xKErjLVZVaSB/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/docs/mintlify-assets/_mintlify/favicons/fga/Ogp9xKErjLVZVaSB/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/docs/mintlify-assets/_mintlify/favicons/fga/Ogp9xKErjLVZVaSB/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/docs/mintlify-assets/_mintlify/favicons/fga/Ogp9xKErjLVZVaSB/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/docs/mintlify-assets/_mintlify/favicons/fga/Ogp9xKErjLVZVaSB/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/docs/mintlify-assets/_mintlify/favicons/fga/Ogp9xKErjLVZVaSB/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"OpenFGA Best Practices - OpenFGA\">\u003cmeta data-mint-head property=\"og:description\" content=\"Overview of best practices when adopting OpenFGA\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"OpenFGA\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://openfga.dev/docs/best-practices/overview\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://openfga.dev/img/og-rich-embed.png\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"OpenFGA Best Practices - OpenFGA\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Overview of best practices when adopting OpenFGA\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://openfga.dev/img/og-rich-embed.png\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/docs/mintlify-assets/_mintlify/favicons/fga/Ogp9xKErjLVZVaSB/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"OpenFGA\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#2c7a3f\">\u003cmeta data-mint-head name=\"openfga:docs-source-sha256\" content=\"52615f566a33686f79387449f56e96ba38f4e369d945db11dcc3be3d69b9b373\">\u003clink data-mint-head rel=\"canonical\" href=\"https://openfga.dev/docs/best-practices/overview\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/docs/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/docs/best-practices/overview.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://openfga.dev/#organization\",\"name\":\"OpenFGA\",\"url\":\"https://openfga.dev\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://raw.githubusercontent.com/openfga/community/22a5668e729b2d5453c6520e6f00c44a99fcd4fc/brand-assets/horizontal/color/black/openfga-horizontal-color_black.svg\"}},{\"@type\":\"WebSite\",\"@id\":\"https://openfga.dev/docs#website\",\"name\":\"OpenFGA\",\"url\":\"https://openfga.dev/docs\",\"publisher\":{\"@id\":\"https://openfga.dev/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://openfga.dev/docs/best-practices/overview#webpage\",\"url\":\"https://openfga.dev/docs/best-practices/overview\",\"name\":\"OpenFGA Best Practices\",\"description\":\"Overview of best practices when adopting OpenFGA\",\"dateModified\":\"2026-09-28T08:14:37.000Z\",\"isPartOf\":{\"@id\":\"https://openfga.dev/docs#website\"},\"breadcrumb\":{\"@id\":\"https://openfga.dev/docs/best-practices/overview#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://openfga.dev/docs/best-practices/overview#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"OpenFGA\",\"item\":\"https://openfga.dev/docs\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"OpenFGA Best Practices\",\"item\":\"https://openfga.dev/docs/best-practices/overview\"}]},{\"@type\":[\"Article\",\"TechArticle\"],\"@id\":\"https://openfga.dev/docs/best-practices/overview#article\",\"headline\":\"OpenFGA Best Practices\",\"name\":\"OpenFGA Best Practices\",\"description\":\"Overview of best practices when adopting OpenFGA\",\"url\":\"https://openfga.dev/docs/best-practices/overview\",\"mainEntityOfPage\":{\"@id\":\"https://openfga.dev/docs/best-practices/overview#webpage\"},\"image\":\"https://openfga.dev/img/og-rich-embed.png\",\"dateModified\":\"2026-09-28T08:14:37.000Z\",\"publisher\":{\"@id\":\"https://openfga.dev/#organization\"},\"isPartOf\":{\"@id\":\"https://openfga.dev/docs#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"OpenFGA\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"OpenFGA","nav":{"global":null,"anchors":[{"anchor":"Docs","hidden":true,"pages":[{"title":"Introduction to OpenFGA","sidebarTitle":"What is OpenFGA","description":"Build relationship-based, role-based, and attribute-based access control at scale.","href":"/fga"},{"title":"Authorization Concepts","sidebarTitle":"Authorization Concepts","description":"Learn fine-grained authorization concepts: ReBAC, RBAC, ABAC, PBAC, and Google Zanzibar. Understand how OpenFGA models permissions for modern apps.","href":"/authorization-concepts"},{"title":"Concepts","description":"Learning about FGA concepts","sidebarTitle":"OpenFGA Concepts","href":"/concepts"},{"title":"Configuration Language","description":"Learning about the FGA configuration language and using it to build a representation of a system's authorization model","href":"/configuration-language"},{"group":"Getting Started","icon":"rocket","pages":[{"title":"Getting Started","description":"OpenFGA tutorial and quickstart: install the server, configure an authorization model, write tuples, and run your first permission checks in minutes.","href":"/getting-started"},{"group":"Setup OpenFGA","pages":[{"title":"Setup OpenFGA","description":"Follow the guides below to set up an OpenFGA server.","href":"/getting-started/setup-openfga/overview"},{"title":"Configuring OpenFGA","description":"Configuring an OpenFGA Server","sidebarTitle":"Configure OpenFGA","href":"/getting-started/setup-openfga/configure-openfga"},{"title":"OpenFGA Configuration Options","description":"Configuring Options for the OpenFGA Server","sidebarTitle":"Configuration Options","href":"/getting-started/setup-openfga/configuration"},{"title":"🐳 Setup OpenFGA with Docker","sidebarTitle":"🐳 Docker","description":"Setting up an OpenFGA server with Docker","href":"/getting-started/setup-openfga/docker"},{"title":"☸️ Setup OpenFGA with Kubernetes","sidebarTitle":"☸️ Kubernetes","description":"Setting up an OpenFGA server with Kubernetes","href":"/getting-started/setup-openfga/kubernetes"},{"title":"🛡️Setup Access Control","sidebarTitle":"🛡️Access Control","description":"How to enable and setup the built-in access control OpenFGA server (experimental)","href":"/getting-started/setup-openfga/access-control"},{"title":"Using the OpenFGA Playground","description":"Setting up an OpenFGA server","sidebarTitle":"Playground","href":"/getting-started/setup-openfga/playground"},{"title":"Reporting Runtime Issues","description":"Information to gather when reporting OpenFGA runtime issues","href":"/getting-started/setup-openfga/reporting-runtime-issues"}]},{"title":"Install SDK Client","description":"Installing SDK client","href":"/getting-started/install-sdk"},{"title":"Create a Store","description":"Creating a store","href":"/getting-started/create-store"},{"title":"Setup SDK Client for Store","description":"Setting up an OpenFGA SDK client","href":"/getting-started/setup-sdk-client"},{"title":"Configure Authorization Model for a Store","sidebarTitle":"Configure Authorization Model","description":"Configuring authorization model for a store","href":"/getting-started/configure-model"},{"title":"Update Relationship Tuples","description":"Introduction to adding and deleting relationship tuples","href":"/getting-started/update-tuples"},{"title":"Perform a Check","description":"Checking if a user is authorized to perform an action on a resource","href":"/getting-started/perform-check"},{"title":"Perform a list objects call","description":"List all objects a user is authorized to perform a specified action for a given resource type","sidebarTitle":"Perform a List Objects Request","href":"/getting-started/perform-list-objects"},{"title":"Perform a List Users call","description":"List all users that have a certain relation with a particular object","sidebarTitle":"Perform a List Users Request","href":"/getting-started/perform-list-users"},{"title":"Use the FGA CLI","description":"Use the FGA CLI","href":"/getting-started/cli"},{"title":"Integrate Within a Framework","description":"Integrating FGA within a framework, such as Fastify or Fiber","href":"/getting-started/framework"},{"title":"Immutable Authorization Models","description":"Learn how to take advantage of the immutable properties of Authorization Models","href":"/getting-started/immutable-models"},{"title":"Best Practices of Managing Tuples and Invoking APIs","description":"The following list outlines some guidelines and best practices for using OpenFGA:","sidebarTitle":"Implementation Best Practices","href":"/getting-started/tuples-api-best-practices"},{"title":"Configure SDK Client Telemetry","description":"How to configure your SDK Client to collect telemetry using OpenTelemetry.","href":"/getting-started/configure-telemetry"}]},{"group":"Modeling Guides","icon":"diagram-project","pages":[{"title":"Modeling Guides","description":"Guides, concepts and examples that help you define an authorization model.","href":"/modeling/overview"},{"title":"Get Started with Modeling","description":"An introduction to modeling","href":"/modeling/getting-started"},{"title":"Direct Access","sidebarTitle":"Direct Access","description":"Granting a user access to an object","href":"/modeling/direct-access"},{"title":"User Groups","sidebarTitle":"User Groups","description":"Adding users to groups and granting group members access to an object","href":"/modeling/user-groups"},{"title":"Roles and Permissions","sidebarTitle":"Roles and Permissions","description":"Modeling basic roles and permissions","href":"/modeling/roles-and-permissions"},{"title":"Parent-Child Objects","sidebarTitle":"Parent-Child Objects","description":"Indicate relationships between objects, and how users' relationships to one object can affect their relationship with another","href":"/modeling/parent-child"},{"title":"Blocklists","description":"Preventing certain users from accessing objects","href":"/modeling/blocklists"},{"title":"Public Access","sidebarTitle":"Public Access","description":"Granting public access to an object","href":"/modeling/public-access"},{"title":"Multiple Restrictions","sidebarTitle":"Multiple Restrictions","description":"Modeling system that requires multiple authorizations before allowing users to perform actions on particular objects","href":"/modeling/multiple-restrictions"},{"title":"Custom Roles","sidebarTitle":"Custom Roles","description":"Modeling custom and dynamically changing roles in your system","href":"/modeling/custom-roles"},{"title":"Conditions","description":"Modeling relationships with Conditions","href":"/modeling/conditions"},{"title":"Use Token Claims As Contextual Tuples","sidebarTitle":"Token claims as Contextual Tuples","description":"Using identity token claims to define contextual relations","href":"/modeling/token-claims-contextual-tuples"},{"title":"Contextual and Time-Based Authorization","sidebarTitle":"Contextual and Time-Based Authorization","description":"Checking relations that depends on certain dynamic or contextual data (such as time, location, ip address, weather) that have not been written","href":"/modeling/contextual-time-based-authorization"},{"title":"Authorization Through Organization Context","sidebarTitle":"Authorization Through Organization Context","description":"Modeling authorization through organization context","href":"/modeling/organization-context-authorization"},{"title":"Testing Models","description":"Test OpenFGA authorization models before deployment.","href":"/modeling/testing"},{"title":"Store File Format","sidebarTitle":"Store File Format","description":"Store File Format (.fga.yaml)","href":"/modeling/store-file-format"},{"title":"Modular Models","description":"Modular Models","href":"/modeling/modular-models"},{"group":"Building Blocks","pages":[{"sidebarTitle":"Building Blocks","title":"Authorization Model Building Blocks","description":"Guides on the building blocks of authorization models in OpenFGA.","href":"/modeling/building-blocks/overview"},{"title":"Direct Relationships","sidebarTitle":"Direct Relationships","description":"Modeling Concepts: Direct Relationships","href":"/modeling/building-blocks/direct-relationships"},{"title":"Concentric Relationships","sidebarTitle":"Concentric Relationships","description":"Modeling Concepts: Concentric Relationships","href":"/modeling/building-blocks/concentric-relationships"},{"title":"Object to Object Relationships","sidebarTitle":"Object to Object Relationships","description":"Modeling relationships between objects (e.g. folder parent of a document)","href":"/modeling/building-blocks/object-to-object-relationships"},{"title":"Usersets","description":"Modeling with userset","href":"/modeling/building-blocks/usersets"}]},{"group":"Advanced Use-Cases","pages":[{"title":"Advanced Use-Cases","description":"Advanced use cases and patterns for authorization modeling","href":"/modeling/advanced/overview"},{"sidebarTitle":"Google Drive","title":"Modeling Google Drive permissions with OpenFGA","description":"Modeling Google Drive permissions","href":"/modeling/advanced/gdrive"},{"sidebarTitle":"GitHub","title":"Modeling GitHub permissions with OpenFGA","description":"Modeling GitHub permissions","href":"/modeling/advanced/github"},{"sidebarTitle":"Slack","title":"Modeling Authorization for Slack with OpenFGA","description":"Modeling authorization for Slack","href":"/modeling/advanced/slack"},{"sidebarTitle":"IoT","title":"Modeling Authorization for an IoT Security System with OpenFGA","description":"Modeling fine-grained authorization for an IoT security camera system","href":"/modeling/advanced/iot"},{"sidebarTitle":"Entitlements","title":"Modeling Entitlements for a System with OpenFGA","description":"Modeling entitlements for a system","href":"/modeling/advanced/entitlements"}]},{"group":"Migrations","pages":[{"title":"Model Migrations","description":"Guides focused on migrating models and relations in OpenFGA.","href":"/modeling/migrating/overview"},{"title":"Migrating Relations","sidebarTitle":"Migrating Relations","description":"Migrating relations","href":"/modeling/migrating/migrating-relations"},{"title":"Model Migrations","description":"Learn how to migrate OpenFGA authorization models, including adding, removing, and renaming types and relations.","sidebarTitle":"Migrating Models","href":"/modeling/migrating/migrating-models"}]}]},{"group":"Authorization for Agents","icon":"robot","pages":[{"title":"Authorization for Agents","description":"Authorization patterns for AI agents and automated processes: model agents as principals, secure RAG pipelines, and control MCP server tool access.","href":"/modeling/agents/overview"},{"title":"Modeling Agents as Principals","description":"Model agents as first-class principals in your authorization model so they inherit access through the same permission hierarchy as users","href":"/modeling/agents/agents-as-principals"},{"title":"RAG Authorization","description":"Retrieval-Augmented Generation (RAG) enhances LLM responses by retrieving relevant documents from a knowledge base. Without authorization checks, a user can ask a question and receive answers derived from documents they should not have access to. OpenFGA lets you enforce document-level permissions so that RAG pipelines only return content the user is authorized to see.","href":"/modeling/agents/rag-authorization"},{"title":"Authorization for MCP Servers","description":"Authorize MCP server tools with OpenFGA: control which tools each user can invoke based on roles, group membership, and time-limited temporal grants.","href":"/modeling/agents/mcp-authorization"},{"title":"Modeling Task-Based Authorization for Agents","description":"Modeling task-based authorization for agents","sidebarTitle":"Task-Based Authorization","href":"/modeling/agents/task-based-authorization"}]},{"group":"Interacting with the API","icon":"code","pages":[{"title":"Interacting with the API","description":"Programmatically writing authorization related data and interact with the API","href":"/interacting/overview"},{"title":"Managing User Access","description":"Granting a user access to a particular object","sidebarTitle":"Manage User Access","href":"/interacting/managing-user-access"},{"title":"Managing Group Access","description":"Granting a group of users access to a particular object","sidebarTitle":"Manage Group Access","href":"/interacting/managing-group-access"},{"title":"Managing Group Membership","description":"Updating a user's membership to a group by adding and removing them from it","sidebarTitle":"Manage Group Membership","href":"/interacting/managing-group-membership"},{"title":"Managing Relationships Between Objects","description":"Granting a user access to a particular object through a relationship with another object","sidebarTitle":"Manage Relationships Between Objects","href":"/interacting/managing-relationships-between-objects"},{"title":"Contextual Tuples","description":"Understanding and using contextual tuples","href":"/interacting/contextual-tuples"},{"title":"Query Consistency Modes","description":"Query Consistency Modes","sidebarTitle":"Query Consistency","href":"/interacting/consistency"},{"title":"Relationship Queries: Check, Read, Expand, ListObjects and ListUsers","sidebarTitle":"Relationship Queries","description":"An overview of how to use the Check, Read, Expand, and ListObject APIs","href":"/interacting/relationship-queries"},{"title":"How to get tuple changes","description":"Getting tuple changes","sidebarTitle":"Get Tuple Changes","href":"/interacting/read-tuple-changes"},{"title":"Search With Permissions","description":"Integrating FGA into your search","sidebarTitle":"Search with Permissions","href":"/interacting/search-with-permissions"},{"title":"AuthZEN API (Experimental)","description":"Using the AuthZEN interoperability API with OpenFGA","sidebarTitle":"AuthZEN API","href":"/interacting/authzen"}]},{"group":"Best Practices","icon":"server","pages":[{"title":"OpenFGA Best Practices","sidebarTitle":"Best Practices","href":"/best-practices/overview"},{"title":"OpenFGA Adoption Patterns","description":"Describe different ways FGA can be adopted in an organization","sidebarTitle":"Adoption Patterns","href":"/best-practices/adoption-patterns"},{"title":"Authorization Model Design Principles","sidebarTitle":"Authorization Model Design Principles","description":"Best practices for creating clear, performant, and maintainable authorization models.","href":"/best-practices/modeling-design-principles"},{"title":"Modeling ABAC with OpenFGA","sidebarTitle":"Modeling ABAC","description":"Learn how to model Attribute-Based Access Control (ABAC) patterns using stored and dynamic attributes in OpenFGA.","href":"/best-practices/modeling-abac"},{"title":"Modeling Roles","description":"Various ways of modeling static and dynamic roles in FGA - both coarse and fine-grained.","sidebarTitle":"Modeling Roles","href":"/best-practices/modeling-roles"},{"title":"When to use OpenFGA as the 'source of truth' for authorization data","description":"Deciding where to store the \"source of truth\" for authorization data","sidebarTitle":"Source of Truth","href":"/best-practices/source-of-truth"},{"title":"Running OpenFGA in Production","sidebarTitle":"Running OpenFGA in Production","description":"Best Practices of Running OpenFGA in a Production Environment","href":"/best-practices/running-in-production"}]},{"group":"Industries","icon":"building","pages":[{"title":"OpenFGA by Industry","sidebarTitle":"Fine-Grained Authorization by Industry","description":"How healthcare, banking, e-commerce, HR, CRM, and LMS teams model fine-grained authorization with FGA.","href":"/industries/overview"},{"title":"Healthcare Authorization with OpenFGA","sidebarTitle":"Healthcare","description":"Model patients, providers, encounters, and HIPAA-regulated PHI access in OpenFGA. Care teams, facility hierarchy, and sensitive-field permissions for EHR.","href":"/industries/healthcare"},{"title":"Banking Authorization with OpenFGA","sidebarTitle":"Banking","description":"Model account managers, account owners, per-transaction limits, and delegation in FGA for banking, fintech, and PCI-DSS-regulated applications.","href":"/industries/banking"},{"title":"E-commerce Authorization with OpenFGA","sidebarTitle":"E-commerce","description":"Model multi-store organizations, staff roles, products, orders, and refunds in FGA for Shopify-style and BigCommerce-style e-commerce platforms.","href":"/industries/ecommerce"},{"title":"HR \u0026 HRIS Authorization with OpenFGA","sidebarTitle":"Human Resources","description":"Model employee records, manager hierarchies, payroll, benefits, and PII isolation in FGA for Workday-style HRIS, HR, and directory systems.","href":"/industries/human-resources"},{"title":"CRM Authorization with OpenFGA","sidebarTitle":"CRM","description":"Model accounts, contacts, leads, opportunities, and territory-based access in FGA for Salesforce-style and HubSpot-style CRM platforms.","href":"/industries/crm"},{"title":"LMS Authorization with OpenFGA","sidebarTitle":"Learning Management","description":"Model courses, classes, enrollments, content authorship, and grading workflows in FGA for Canvas-style and Moodle-style learning management systems.","href":"/industries/lms"},{"title":"ATS Authorization with OpenFGA","sidebarTitle":"Applicant Tracking","description":"Model jobs, candidates, applications, interviews, scorecards, and offer workflows in FGA for Greenhouse-style and Lever-style applicant tracking systems.","href":"/industries/applicant-tracking-system"}]},{"group":"Use Cases","icon":"lightbulb","pages":[{"title":"OpenFGA Use Cases","description":"Production-ready OpenFGA patterns for AI agents, RAG, MCP servers, multi-tenant SaaS, and microservices authorization.","href":"/use-cases/overview"},{"title":"AI Agent Authorization","description":"Authorize AI agents with OpenFGA. Model agents as principals, delegate user permissions, and enforce least privilege for autonomous and copilot agents.","sidebarTitle":"AI Agent Authorization","href":"/use-cases/ai-agent-authorization"},{"title":"RAG Authorization","description":"Enforce per-user permissions on retrieval-augmented generation. Filter retrieved documents through OpenFGA before they reach the model.","sidebarTitle":"RAG Authorization","href":"/use-cases/rag-authorization"},{"title":"MCP Server Authorization","description":"Authorize Model Context Protocol (MCP) servers with OpenFGA. Per-tool, per-resource permission checks on every MCP request.","sidebarTitle":"MCP Server Authorization","href":"/use-cases/mcp-server-authorization"},{"title":"Multi-Tenant SaaS Authorization","description":"Authorize multi-tenant SaaS applications with OpenFGA. Strict tenant isolation, shared infrastructure, and cross-tenant sharing where you want it.","sidebarTitle":"Multi-Tenant SaaS","href":"/use-cases/multi-tenant-saas"},{"title":"Microservices Authorization","description":"Centralize authorization across microservices with OpenFGA. One model, one store, one set of decisions — instead of a roles table per service.","sidebarTitle":"Microservices Authorization","href":"/use-cases/microservices-authorization"}]},{"group":"Adopters","icon":"handshake","pages":[{"title":"OpenFGA in production","description":"Production OpenFGA case studies from Agicap, Docker, Grafana Labs, Headspace, OpenLane, Read AI, Vitrolife, Zuplo and other adopters running fine-grained authorization at scale.","sidebarTitle":"OpenFGA Adopters and Case Studies","href":"/adopters/overview"},{"title":"Agicap: Fine-grained authorization for a European fintech platform","description":"How European fintech Agicap runs OpenFGA in production for 8,000+ customers at 250 RPS with conditional ReBAC across every backend service.","sidebarTitle":"Agicap","href":"/adopters/agicap"},{"title":"Docker: Centralizing permissions with ReBAC","description":"How Docker migrated to OpenFGA with a parallel-run strategy and now uses ReBAC to centralize permissions across products.","sidebarTitle":"Docker","href":"/adopters/docker"},{"title":"Grafana Labs: From single-tenant engine to multi-tenant ReBAC","description":"Why Grafana Labs replaced its single-tenant access control engine with OpenFGA to power multi-tenant Grafana Cloud and embedded OSS deployments.","sidebarTitle":"Grafana Labs","href":"/adopters/grafana"},{"title":"Read AI: 5 billion tuples, 20ms p99 latency","description":"How Read AI runs OpenFGA at 5,200 requests per second with 20ms p99 latency over more than 5 billion relationship tuples.","sidebarTitle":"Read AI","href":"/adopters/read-ai"},{"title":"Headspace: Authorizing an empathetic AI companion at consumer scale","description":"How Headspace authorizes Ebb, its empathetic AI companion, with OpenFGA — driving end-to-end checks down from 10-15 seconds to 10-15 milliseconds.","sidebarTitle":"Headspace","href":"/adopters/headspace"},{"title":"Zuplo: Edge authorization across multiple data centers","description":"How API management platform Zuplo runs OpenFGA across multiple data centers with PostgreSQL global replication for edge authorization.","sidebarTitle":"Zuplo","href":"/adopters/zuplo"},{"title":"Openlane: Authorization at the data-access layer for compliance automation","description":"How compliance-automation startup OpenLane wires OpenFGA into ent at the data-access layer, with overfetch + BatchCheck replacing slow ListObjects.","sidebarTitle":"Openlane","href":"/adopters/openlane"},{"title":"Vitrolife Group: Hybrid Entra + OpenFGA authorization for a .NET healthcare platform","description":"How Vitrolife combines Microsoft Entra ID app roles with OpenFGA fine-grained ReBAC for a .NET 10 metadata platform serving IVF clinics worldwide.","sidebarTitle":"Vitrolife Group","href":"/adopters/vitrolife"}]},{"group":"Learn","icon":"graduation-cap","pages":[{"title":"Learn Authorization","description":"Authorization concepts explained — Zanzibar, ReBAC, RBAC, ABAC, fine-grained authorization, and policy engines — with FGA examples.","href":"/learn/overview"},{"title":"What is Google Zanzibar?","description":"Zanzibar is a 2019 paper from Google describing the authorization system used by Google Drive, YouTube, Calendar, Cloud, and most other Google products. It is the source of the design pattern OpenFGA implements.","sidebarTitle":"Zanzibar","href":"/learn/zanzibar"},{"title":"What is ReBAC?","description":"ReBAC models permissions as relationships between users and resources. Learn what ReBAC is, when to use it, and how OpenFGA implements it.","href":"/learn/rebac"},{"title":"RBAC vs. ReBAC","description":"RBAC assigns roles to users; ReBAC models relationships between users and resources. Learn when roles run out and ReBAC takes over.","sidebarTitle":"RBAC vs ReBAC","href":"/learn/rbac-vs-rebac"},{"title":"ABAC vs. ReBAC","description":"ABAC decides on attributes; ReBAC decides on relationships. Learn which fits which problem — and how OpenFGA covers both via conditions.","sidebarTitle":"ABAC vs ReBAC","href":"/learn/abac-vs-rebac"},{"title":"What is Fine-Grained Authorization?","description":"Fine-grained authorization decides access at the resource and action level. Learn what FGA is, what it buys you, and how OpenFGA implements it.","sidebarTitle":"Fine-Grained Authorization","href":"/learn/fine-grained-authorization"},{"title":"Policy Engines vs. Relationship Engines","description":"Policy engines like OPA and Cedar evaluate rules over data. Relationship engines like OpenFGA store and query the graph. Here's when to use which.","sidebarTitle":"Policy vs Relationship Engines","href":"/learn/policy-engine"}]}]},{"anchor":"API Reference","hidden":true,"pages":[{"title":"API Reference","href":"/api/service/stores/list-all-stores"}]}]},"title":"OpenFGA Best Practices - OpenFGA","buildId":"dpl_GvhK4qVXq51DpfYJLCtPpYNN4YHN","deploymentId":"dpl_GvhK4qVXq51DpfYJLCtPpYNN4YHN","dynamics":[],"chunks":[]}