What is Fine-Grained Authorization?

​

What “fine-grained” actually buys you

• Per-resource sharing. A user can be granted access to one document without inheriting access to everything in the workspace.
• Hierarchical inheritance. Access to a folder grants access to its documents — but only that folder, not every folder.
• Reverse queries. “List every document this user can read” — the query a UI needs to render correctly.
• Cross-tenant collaboration. Granting a single resource to an external user without making them a tenant member.

​

How OpenFGA implements FGA

• A typed model defines resource types and the relations between them.
• Tuples record specific relationships between specific principals and specific resources.
• The check API answers per-action questions in milliseconds.
• Conditions cover attribute-driven cases inside the same model.

​

Where FGA matters most

• Document management and collaboration (Google Drive, Notion, Figma patterns).
• Multi-tenant SaaS with external sharing.
• AI agents and RAG, where each user must only see their slice of the corpus — covered in AI agent authorization.

​

Choosing the right model

• Flat access, a handful of roles, single tenant — RBAC is enough.
• Decisions driven mostly by request attributes (region, department, time-of-day) — start with ABAC or a policy engine.
• Hierarchy, sharing, multi-tenancy, or reverse queries — you want a relationship engine. OpenFGA handles attribute checks too via conditions, so you usually don’t need a second engine.
• Mixed infrastructure + application policy — a policy engine at the admission layer plus OpenFGA for the application is the common pairing.

​

Related reading