# apache/casbin

Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.

Repository: https://github.com/apache/casbin
Canonical: https://ross.abutalabs.com/products/casbin
Homepage: https://casbin.apache.org/
Language: Go
License: Apache-2.0
License Family: permissive
Topics: casbin, access-control, authorization, rbac, abac, acl, auth, authz, permission, authentication, authn, iam, sso, cas, oauth, oidc, saml, apache
Last push: 2026-08-21T08:53:52+00:00

## Health v2 (maintenance only)
Score: 98/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 98, release rhythm 98, longevity 100
- inputs: {"age_days": 3434, "days_push": 12, "days_rel": 13, "gap_med": 2.0, "n_releases_24m": 55}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 20349, forks 1755 (observed 2026-08-28T04:11:30.013978+00:00)

## What it is
Apache Casbin is an open-source authorization library that enforces access control using models such as ACL, RBAC, ABAC, ReBAC, and MAC, defined via PERM metamodel configuration files. It is implemented natively in many languages (Go, Java, Node.js, PHP, Python, .NET, Rust, C++, and more) with consistent APIs and pluggable policy storage adapters for databases, files, and cloud storage.

## Use cases
- enforce role-based access control in a Go web app
- implement ABAC permission checks with attribute conditions
- store authorization policies in MySQL or Postgres
- manage RBAC role hierarchies across microservices
- switch access control models without rewriting code
- add multi-tenant authorization with filtered policy loading
- centralize authz logic across multiple programming languages

## When to choose
- you need flexible, model-driven authorization (ACL/RBAC/ABAC) decoupled from application code
- you want consistent authorization logic across polyglot services
- you need pluggable policy persistence in many databases or storage backends
- you want a mature, widely adopted access control engine with an online policy editor

## When to avoid
- you only need simple hardcoded role checks with no policy flexibility
- you need full-featured authentication (login, OAuth/OIDC flows) - Casbin handles authorization, not authentication
- your language lacks the adapter or feature (e.g., watcher, filtered adapter) you require

## Facets
- artifact type: library
- maturity: stable
- function: authorization, auth, security, middleware
- domain: security, backend, developer-tools, apis
- platform: go, cross-platform, jvm, python, rust, cpp, dotnet, php
- tags: rbac, abac, acl, access-control, iam, policy-engine, perm-metamodel, multi-language, nodejs

## Member repositories
- apache/casbin (main) score 98

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:11:30.013978+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T16:59:01.632036+00:00, confidence not recorded.
  - readme: https://github.com/apache/casbin (fetched 2026-08-28T04:11:30.013978+00:00, sha 4d176afcab39)
  - homepage: https://casbin.apache.org/ (fetched 2026-08-29T07:57:41.012189+00:00, sha 65e3cbc745a4)
  - site_page: https://casbin.apache.org/docs/overview (fetched 2026-08-29T07:57:41.021320+00:00, sha e6df9330fc66)
  - site_page: https://casbin.apache.org/docs/downloads (fetched 2026-08-29T07:57:41.023668+00:00, sha 34577d2c2ff2)
  - site_page: https://casbin.apache.org/docs/get-started (fetched 2026-08-29T07:57:41.026683+00:00, sha 1cef184398ca)
  - site_page: https://casbin.apache.org/docs/category/access-control-models (fetched 2026-08-29T07:57:41.029100+00:00, sha 323b2c9c0a23)
  - site_page: https://casbin.apache.org/docs/category/storage (fetched 2026-08-29T07:57:41.030850+00:00, sha 36570671a14a)
  - site_page: https://casbin.apache.org/docs/adapters (fetched 2026-08-29T07:57:41.032417+00:00, sha cd140120068d)
  - site_page: https://casbin.apache.org/docs/category/api (fetched 2026-08-29T07:57:41.034800+00:00, sha 4099ba1bb75f)
  - site_page: https://casbin.apache.org/docs/ide-plugins (fetched 2026-08-29T07:57:41.036455+00:00, sha 5a9e92f4f45a)
- Data as of 2026-08-30T08:39:29.467469+00:00.