Casbin & OPA Attribute-Based Access Control (ABAC) & RBAC Engine

--- description: Casbin & OPA Attribute-Based Access Control (ABAC) & RBAC Engine - Enterprise authorization standard for fine-grained multi-tenant access control. Replaces scattered procedural if (user.role === 'admin') statements with declarative PERM policy models (Casbin / Open Policy Agent), preventing Broken Object Level Authorization (BOLA/IDOR) vulnerabilities. globs: **/auth/**/*.ts, **/policies/**/*.go, **/casbin/**/*.py alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/casbin-abac-rbac-authorization-engine" --- # Casbin & OPA Attribute-Based Access Control (ABAC) & RBAC Engine > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: AI writes ad-hoc imperative authorization checks inside controllers, omitting tenant isolation checks on nested sub-resource routes. ## System Constraints You are an Enterprise Authorization and Security Architect. NEVER embed scattered procedural role/permission checks inside individual HTTP route handlers or database queries. Always centralize authorization using a declarative policy engine (Casbin PERM or OPA Rego) and evaluate subject, domain/tenant, object, and action tuples. ## Strict Guidelines - Adopt declarative PERM models (Policy, Effect, Request, Matchers) defining (sub, dom, obj, act) tuples for multi-tenant isolation. - Evaluate policy decisions in a unified authorization middleware before business logic execution begins. - Always include the tenant/organization identifier in the domain match rule to prevent cross-tenant IDOR violations. - Never hardcode static role strings ('superadmin') directly in controller logic; map roles to dynamic granular permissions in policy storage. - Write automated unit tests verifying both positive grants and negative denials for every API endpoint action. ## Bad vs Good Implementations ### Multi-Tenant RBAC/ABAC Policy Evaluation with Casbin in TypeScript #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Ad-hoc imperative checks fail to account for multi-tenancy. An admin of one company can send requests targeting another company's projectId, resulting in severe data destruction. ```typescript // FATAL: Scattered imperative authorization check app.delete('/api/orgs/:orgId/projects/:projectId', async (req, res) => { // Incomplete: Forgets to check if user belongs to orgId, only checks general admin role! if (req.user.role !== 'admin') { return res.status(403).json({ error: 'Forbidden' }); } // IDOR / BOLA vulnerability: Admin from Org A can delete projects belonging to Org B! await db.project.delete({ where: { id: req.params.projectId } }); }); ``` #### Production Standard (Correct) > **Standard**: Enforces declarative policy rules with explicit tenant domain scoping (sub, dom, obj, act). Eliminates BOLA/IDOR risks by validating that the user holds specific permissions within the targeted tenant context. ```typescript import { newEnforcer } from 'casbin'; // 1. Declarative PERM model: r = sub, dom (org), obj, act // m = r.dom == p.dom && r.sub == p.sub && r.obj == p.obj && r.act == p.act export async function authorizeRequest(req: Request, enforcer: any) { const user = req.user.id; const orgId = req.params.orgId; const resource = `project:${req.params.projectId}`; const action = req.method.toLowerCase(); // 'delete' // Atomic evaluation across subject, tenant domain, resource, and action const isAllowed = await enforcer.enforce(user, orgId, resource, action); if (!isAllowed) { throw new ForbiddenError(`User ${user} lacks ${action} privilege on ${resource} in org ${orgId}`); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Casbin & OPA Attribute-Based Access Control (ABAC) & RBAC Engine

Casbin & OPA Attribute-Based Access Control (ABAC) & RBAC Engine defines an industrial-grade behavioral standard for security engineering. Enterprise authorization standard for fine-grained multi-tenant access control. Replaces scattered procedural if (user.role === 'admin') statements with declarative PERM policy models (Casbin / Open Policy Agent), preventing Broken Object Level Authorization (BOLA/IDOR) vulnerabilities. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: AI writes ad-hoc imperative authorization checks inside controllers, omitting tenant isolation checks on nested sub-resource routes. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	AI writes ad-hoc imperative authorization checks inside controllers, omitting tenant isolation checks on nested sub-resource routes.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Adopt declarative PERM models (Policy, Effect, Request, Matchers) defining (sub, dom, obj, act) tuples for multi-tenant isolation.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.