Oso Blog

"Negative permissions have consistently been regarded as bad practice and often treated as theoretical concept...If you find yourself reliant on them, consider one of the following actions: Restructure your permissions into proper allow rules; this is the most recommended approach." This resonates. Negative permissions can be a real footgun, which is why we are being very surgical on if/where to introduce them at Oso[1] [1] https://www.osohq.com/

Oso | https://www.osohq.com Oso is building authorization for the next billion developers. We are building the product in Rust, which we think is both a good design choice for our use case and a fun choice for the team. I recently joined the team and absolutely love the culture and I'm inspired by the talented engineers I get to work with :) Current open roles: - Engineering Manager (NYC) - Software Engineer (NYC or Remote) - Developer Experience Engineer (NYC or Remote) - Head of Engineering (NYC) All open roles - https://www.osohq.com/company/jobs A bit more about Authorization: https://www.osohq.com/academy Our Slack community: http://join-slack.osohq.com/

https://www.osohq.com/ is a very interesting company in this space. They have an open source authorization library, and a great blog.

As a founder of a startup building an authorization product, I can definitely say it's super appealing to build this as a service! It makes for a an easier story around monetising it. When we were building Oso [1], we were optimising for the best thing for developers, and reached the same conclusion as you... (a) It doesn't make sense to rearchitect your app to move all the data to a separate service, and (b) it's way less complex to build it in the application. That's why we're building Oso as an open source library instead. You get to leave your application data in the application, and don't need to worry about adding an external service to the critical path. [1]: https://www.osohq.com/

Yeah, I fully agree. The tooling for putting that much logic into the database is just not great. I've been decently happy with Sqitch[0] for DB change management, but even with that you don't really get a good basis for testing some of the logic you could otherwise test in isolation in app code. I've also tried to rely heavily on the database handling security and authorization, but as soon as you start to do somewhat non-trivial attribute-/relationship-based authorization (as you would find in many products nowadays), it really isn't fun anymore, and you spend a lot of the time you saved on manually building backend routes on trying to fit you authz model into those basic primitives (and avoiding performance bottlenecks). Especially compared to other modern authz solutions like OPA[1] or oso[2] it really doesn't stack up. [0]: https://github.com/sqitchers/sqitch [1]: https://www.openpolicyagent.org [2]: https://www.osohq.com

> do you have an opinion on which enterprise-grade AuthZ provider works best with Supabase? Since you asked for my personal opinion, then I would say Postgres Row Level Security for AuthZ. RLS is as powerful as it is flexible. It's fully-integrated with the rest of the Supabase stack, and it's portable if you don't like supabase - just pg_dump and take it to your favourite Postgres provider. That said, I understand why it's useful to have something more structured like RBAC. We have experimented with a ideas here (specifically ABAC), using a custom libraries/extensions/custom claims[0]. We do something similar internally, but aren't 100% happy with the developer experience and don't plan to release it any time soon. I'm sure the Auth team won't enjoy me saying this, but I like the idea of Zanzibar. I've seen some experimental Postgres extensions[1] that combine Oso[2] + RLS which I'd love to try when I get time. [0] custom claims: https://dev.to/supabase/supabase-custom-claims-34l2 [2] Oso + RLS: https://github.com/MFAshby/rls_oso [1] Oso: https://www.osohq.com/

There's an interesting section here about one of my favourite challenges in authorization: how to efficiently return a list of things that the current user has permission to access, without running a "can_access()" permission check on every single one of them (which is bad if you have thousands of items and you want to paginate them). Their solution is to let you configure rules that get turned into SQL fragments that you can run against your own database: https://www.osohq.com/docs/guides/integrate/filter-lists#list-filterin… - example Rails app here: https://github.com/osohq/rails_list_filtering_sample_app A team I worked with in the past came to the same conclusion - turning authorization rules into WHERE clauses is a very efficient way to solve this problem, if you can figure out a clean way to do it.

For application authorization, Oso is a compelling solution. (Disclaimer: I work for Oso). It provides a DSL and a prescriptive, but flexible data model that are capable of modeling RBAC, ReBAC, ABAC, or whatever else you'd like to model. Obviously I'm biased, but I think it strikes a great balance between opinion and flexibility. One significant complication that all centralized authorization solutions share is that you end up needing to reproduce application data in the authorization system. We've been doing a lot of work in this area to simplify data management and have some beta functionality available. I'll include some links to the docs for those. Sync and reconcile data: https://www.osohq.com/docs/guides/data/sync-data#initial-sync Filter lists with decentralized data (about halfway down): https://www.osohq.com/docs/guides/enforce/filter-lists

Here are some other AuthZ as a service providers I've heard of: * Permit.io: https://www.permit.io/ * Oso: https://www.osohq.com/ And Otterize has an interesting model if you are in the k8s ecosystem: https://otterize.com/ I don't have first hand experience with any of these folks, though I have chatted with some of them.

I’m currently building a service and I’m using casbin for authorization. So far so good, but my requirements at the moment are fairly simple. This will change in the future and it’s one of the reasons I picked it: it’s easy to evolve the permissions layer without changing almost any code. In terms of my experience so far it was a bit tricky at first but once I grasped the concept it became easy to integrate. Most of the blogs with examples I found were in Chinese and the documentation is sometimes confusing to read, so you may need to overcome that part. A few weeks ago I learned about Oso[1] which looks really nice but I haven’t tried it yet. They publish some nice posts about the subject in their academy[2] [1] https://www.osohq.com/ [2] https://www.osohq.com/developers/authorization-academy

Ozo[1] is another authorization language, but based on Prolog. It'd be interesting to compare the capabilities between the two. [1] https://www.osohq.com

Congrats on the launch! I work at Oso [1], also an NYC-based security startup but with half as many consonants and co-founding Sams. cue spiderman meme [1]: https://www.osohq.com/

*Old problem, new $25B+ market* Companies like AWS, Stripe, and Twilio have shown that if a technology isn't core to your value proposition, you should offload it. Still, every engineering team builds and rebuilds one piece: authorization, how you control who has access to what in your app. We intend to change that. We see a world where developers never roll their own authorization again, and instead say, "Just use Oso" – the same way you might say, "Oh, you should just use Postgres for that." In doing so, we're creating the $25B+ authorization market. *Why Oso?* We have the lead – in traction, capital, and team. - Traction: Oso is used by thousands of companies from startups to the Fortune 500, like Wayfair, Arc, Intercom, Visa, Oxide, and Codecademy. - Capital: We're the best-capitalized, with 4+ years of runway from the world’s best investors, including Sequoia, Felicis, and infrastructure entrepreneurs like Olivier Pomel (Founder, Datadog), Dev Ittycheria (CEO, MongoDB), Arman Dadgar (Founder, Hashicorp), Edith Harbaugh (Founder, LaunchDarkly), Guy Podjarny (Founder, Snyk), Paul Copplestone, (Founder, Supabase), Christina Cacioppo (Founder, Vanta), and Calvin French-Owen (Founder, Segment). - Team: We've spent 3+ years going deep on the domain. We've met with thousands of engineering teams and know more about this problem than anyone. And we have two of the best developer go-to-market leaders on earth who have done it before at MongoDB at Snyk. *Why now?* We're…

> neither of the solutions you called out has been out for more than ~1 year, That's a good callout. These are still early days when it comes to Zanzibar & co, and all implementations are very new. I'm glad different implementations exist. This will allow the community to experiment with multiple ideas and allow them to flourish or be discarded. Authzed's idea Jimmy linked to elsewhere (Caveats) [0] is not in the Zanzibar paper, however it is an interesting option to try to tackle ABAC scenarios within a Zanzibar context. OSO (and Aserto seems to be doing the same) is approaching this the other way - they have a good Policy/ABAC solution, do they benefit from a more Zanzibar-like approach to the AuthZ problem, the answer seems to be also yes (OSO Cloud [1]). In OpenFGA, we dropped the concept of Zookies. Will we regret this? Time will tell. SpiceDB bet on the importance of Zookies, and in some cases they are right. We also added support for having multiple model versions active at the same time and some ABAC scenarios through Contextual Tuples [2] (less powerful than caveats, but more Zanzibar-y). Is that a good idea? Hopefully! That's the beauty of it, there are considerations (pros and cons) for all of these approaches, users can pick and choose what works best for their situations. We will all learn and adapt. We may all end up discarding some of our assumptions and adopting new ones. Ultimately this will benefit all of us, and more importantly the wider audience and…

Oso | Engineering Leader, Software Engineer, Developer Experience Engineer, Product Leader | New York City (NYC) | Onsite or Remote Over the last 15 years, companies like AWS, Stripe, and Twilio have helped developers offload anything not core to their apps so they can focus on what matters to their users. Despite a lot of progress in developer tooling, most developers still roll their own authorization. You might start with something quick 'n dirty – some IF statements and roles in a database, which may not be pretty but gets the job done...until you need to add more features, and more features. And inevitably every team band-aids onto this system until they do a big refactor. This is lost time for an area that's not core to what most companies are trying to solve for their users, and what's more, no one on the team is feeling great about this work. At Oso (backed by Sequoia), we're building the first batteries-included framework for authorization so developers don't have to roll it on their own ever again. We're designing slick APIs to cut down the amount of time they spend getting their system set up, and building a fully-fledged policy engine and programming language (in Rust) under the hood to ensure they can customize their system however they need. We don't have any product managers – the engineers on the team are responsible for taking broad problems, experimenting with potential solutions and shipping a superhuman experience for our users. The team members who…

Disclaimer: I am a founder of Authzed (W21)[0]. It always depends on the domain. If the data model for the app is simple enough, RLS can take you pretty far. Enterprise apps that require you to support the various vague interpretations of "RBAC" or domains that have more complex data models will eventually need some kind of more sophisticated authorization solution. There are a variety solutions at that point (e.g. SpiceDB[1], oso[2], OPA[3]) and you'll be making your decision based on not only the implementation of the technology, but concerns that have cropped in your business requirements: - "How will additional microservices check permissions?" - "How can we test and enforce that our authorization system is correct?" - "Can I support user-defined permissions?" [0]: https://authzed.com [1]: https://github.com/authzed/spicedb [2]: https://www.osohq.com [3]: https://www.openpolicyagent.org

Oso | Software Engineer, Developer Advocate, & Eng Manager | New York City (NYC) | Onsite or Remote Over the last 15 years, companies like AWS, Stripe, and Twilio have helped developers offload anything not core to their apps so they can focus on what matters to their users. Despite a lot of progress in developer tooling, most developers still roll their own authorization. You might start with something quick 'n dirty – some IF statements and roles in a database, which may not be pretty but gets the job done...until you need to add more features, and more features. And inevitably every team band-aids onto this system until they do a big refactor. This is lost time for an area that's not core to what most companies are trying to solve for their users, and what's more, no one on the team is feeling great about this work. At Oso (backed by Sequoia), we're building the first batteries-included library for authorization so developers don't have to roll it on their own ever again. We're designing slick APIs to cut down the amount of time they spend getting their system set up, and building a fully-fledged policy engine and programming language (in Rust) under the hood to ensure they can customize their system however they need. We don't have any product managers – the engineers on the team are responsible for taking broad problems, experimenting with potential solutions and shipping a superhuman experience for our users. The team members who join now will not only have a…

Have you looked into Local Authorization? https://www.osohq.com/docs/develop/facts/local-authorization it lets you apply authz filters to paginated search over a database, even if some of the data the authz depends on isn't stored in the database

Oso | Multiple Roles | New York, NY | ONSITE | Competitive Salary + Equity Oso is a developer-first authorization system that makes access control simple and scalable. Backed by Sequoia and Felicis with $26M raised, we're trusted by thousands of companies from startups to the Fortune 500. Join us at the inflection point as we lead the creation of a $25B+ market. We're hiring for: - Engineering Manager - Development Experience Engineer Check out our openings here: https://www.osohq.com/company/jobs Interested? Reach out to [email protected].

Here are a few OPA alternatives: https://www.osohq.com/learn/open-policy-agent-authorization-alternativ…

Oso | Multiple Roles | New York, NY | Onsite Oso is a developer-first authorization system that makes access control simple and scalable. Backed by Sequoia and Felicis with $26M raised, we're trusted by thousands of companies from startups to the Fortune 500. Join us at the inflection point as we lead the creation of a $25B+ market. We're hiring for: - Software Engineers - Engineering Manager - Forward Deployed Engineer Check out our openings here: https://www.osohq.com/company/jobs. Reach out directly to [email protected] if interested.

Oso posted a blog post [1] about this yesterday that's quite informative. I separated posted it on HN [2], but linking here. [1] https://www.osohq.com/post/why-llm-authorization-is-hard [2] https://news.ycombinator.com/item?id=44509936

Oso is abandoned by its authors: https://www.osohq.com/docs/oss/getting-started/deprecation.html

A bit salse-y, but Oso has a pretty nice overview on the problems that led to their product and how they reason about AuthN/AuthZ: https://www.osohq.com/academy It's more focused on application level architecture rather than the whole domain of AuthN/AuthZ, but I've found it's a decent reference for folks unfamiliar with a lot of the common issues one encounters in implementation.

Zanzibar in particular is designed to be able to answer the question "what can this user access?", or "who can access resource X?" as well as "can user Y access resource Y?". This article from OSO [1] explains how, with references to tweets from Lea Kissner (one of the authors of the paper and implementors) which are unfortunately less useful now that Twitter threads have been vandalised. [1]: https://www.osohq.com/post/zanzibar

Just a heads up, looks like markdown formatting got into your "go get" command for the golang page. https://www.osohq.com/learn/rbac-go

It looks like they charge for support. https://www.osohq.com/developers/support

> We have a post on this coming soon! The short version is that Polar is a logic language based on Prolog/Datalog/miniKanren. And logic languages are a particularly good fit for representing the branching conditional logic you often see in authorization configurations. Ha, I've been playing around with Biscuits (https://www.biscuitsec.org/) and was writing up a blog post on using them in a git forge. When I saw the Polar data units described as "facts" and read your end to end example (https://www.osohq.com/docs/tutorials/end-to-end-example) I thought "Oh this looks very similar". I will say - I do like how Polar seems to type stuff and provide some concepts that Biscuits force you to build out on your own, that's pretty neat. What is the proof of identity in Polar? Is it something like a token in Biscuits? I'm curious if you can do things like add caveats to reduce what the token is capable of as it gets handed off to different systems. I consider that one of the "killer use cases" of biscuits.

I think the most important place to start is appreciating the distinction between authentication ("is the person trying to use my application really the person they say they are?", abbreviated "authn") and authorization ("is this person allowed to perform the action they're trying to perform?", abbreviated "authz"). Most of the comments on this page are referring to authentication. It's important to know, but also the piece you're likely to spend far less time on. It's where most of the heavy lifting will be done by some vendor or tool you set up instead of by your own code. Authorization is far less likely to be something you get off the shelf and far more likely to be where you spend significant time. It can be very intimately connected to your business logic. Active Directory roles and groups are one authorization solution for a particular class of problems but I have only seen them used for controlling business internal assets (mostly file servers); not public-facing applications. I really like Oso Academy as a resource for authorization topics. It's structured like a progressive course, though I don't know if they have the kind of exercises you mentioned. https://www.osohq.com/academy