apache/casbin

Health v2 · maintenance only

Adoption not part of the score

20349 stars · 1755 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Apache Casbin is an open-source authorization library that enforces access control using models such as ACL, RBAC, ABAC, ReBAC, and MAC, defined via PERM metamodel configuration files. It is implemented natively in many languages (Go, Java, Node.js, PHP, Python, .NET, Rust, C++, and more) with consistent APIs and pluggable policy storage adapters for databases, files, and cloud storage.

Use cases

• enforce role-based access control in a Go web app
• implement ABAC permission checks with attribute conditions
• store authorization policies in MySQL or Postgres
• manage RBAC role hierarchies across microservices
• switch access control models without rewriting code
• add multi-tenant authorization with filtered policy loading
• centralize authz logic across multiple programming languages

When to choose

• you need flexible, model-driven authorization (ACL/RBAC/ABAC) decoupled from application code
• you want consistent authorization logic across polyglot services
• you need pluggable policy persistence in many databases or storage backends
• you want a mature, widely adopted access control engine with an online policy editor

When to avoid

• you only need simple hardcoded role checks with no policy flexibility
• you need full-featured authentication (login, OAuth/OIDC flows) - Casbin handles authorization, not authentication
• your language lacks the adapter or feature (e.g., watcher, filtered adapter) you require

Facets

library · maturity stable

authorization auth security middleware security backend developer-tools apis go cross-platform jvm python rust cpp dotnet php rbac abac acl access-control iam policy-engine perm-metamodel multi-language nodejs

Member repositories

For agents

markdown · JSON · MCP: product_card(name="apache/casbin")