Help us shape the future of Go! Take the 2026 Go Developer Survey

Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

authz

package module

Go to main page

Versions in this module

v0

v0.1.1

Oct 24, 2026

v0.1.0

Oct 23, 2026

Changes in this version

+ const NamedDefinitionAction

+ var ErrConflict = errors.New("policy revision conflict")

+ var ErrDenied = errors.New("access denied")

+ var ErrIdentityDenied = fmt.Errorf("%w: verified identity rejected", ErrDenied)

+ var ErrSelectionDenied = fmt.Errorf("%w: selected entity scope rejected", ErrDenied)

+ var ErrSelectionRequired = fmt.Errorf("%w: explicit entity selection required", ErrDenied)

+ var ErrUnavailable = errors.New("authorization service unavailable")

+ func HasPermission(grants []EntityPermission, entityType string, id EntityID, permission string) bool

+ func ParseGrantedScopes(claim string) ([]string, error)

+ func PoliciesContentHash(policies map[string]Policy) (string, error)

+ func PolicyContentHash(action string, policy Policy) (string, error)

+ func ResolveNamedDocument(ctx context.Context, source Store, document Document) (Document, []NamedDependency, error)

+ func RuleContentHash(rule Rule) (string, error)

+ func ValidateDocument(doc Document) error

+ func ValidateEntityPermissions(grants []EntityPermission) error

+ func ValidatePolicy(action string, p Policy) error

+ type Administration struct

+ EditorCheck func(context.Context, Facts, Resource) (bool, error)

+ EditorRoles []string

+ Management *Service

+ Provider Provider

+ Store Store

+ func (a *Administration) CanReplace(ctx context.Context, resource Resource) (bool, error)

+ func (a *Administration) Create(ctx context.Context, doc Document) (Document, error)

+ func (a *Administration) Get(ctx context.Context, resource Resource) (Document, error)

+ func (a *Administration) Replace(ctx context.Context, doc Document) (Document, error)

+ type Choice struct

+ Entity *Entity

+ ID string

+ Label string

+ type Choices struct

+ Entities []Choice

+ EntityTypes []string

+ Exposures []Choice

+ MembershipGroups []Choice

+ Roles []Choice

+ Subjects []Choice

+ type Creator interface

+ Create func(context.Context, Document, string) (Document, error)

+ type Decision struct

+ Bounded bool

+ Entities []Entity

+ func Evaluate(req Request, policies map[string]Policy, facts Facts, now time.Time) (Decision, error)

+ func EvaluatePrepared(req Request, policies map[string]Policy, prepared *PreparedFacts, ...) (Decision, error)

+ func Intersect(left, right Decision) (Decision, error)

+ type DecisionProvider interface

+ Evaluate func(context.Context, Request, Document, Facts) (Decision, error)

+ type Directory interface

+ Choices func(context.Context, Resource, Facts) (Choices, error)

+ type Document struct

+ Policies map[string]Policy

+ Resource Resource

+ Revision int64

+ type EditorContext struct

+ CanManage bool

+ Choices Choices

+ Source string

+ type Entity struct

+ ID string

+ Type string

+ func NormalizeEntityGroups(groups EntityGroups) ([]Entity, error)

+ type EntityGroups map[string][]EntityID

+ func DecodeEntityGroups(raw []byte) (EntityGroups, error)

+ func GroupEntities(flat []Entity) (EntityGroups, error)

+ type EntityID string

+ func (id *EntityID) UnmarshalJSON(raw []byte) error

+ type EntityPermission struct

+ ID EntityID

+ Permissions []string

+ Type string

+ type EntityPermissionIndex map[string]map[string][]string

+ func IndexEntityPermissions(grants []EntityPermission, decision Decision) (EntityPermissionIndex, error)

+ type Facts struct

+ AuthorityRevision string

+ Entities []Entity

+ EntityGroups EntityGroups

+ EntityPermissions []EntityPermission

+ Exposures []string

+ GrantedScopes []string

+ Issuer string

+ MembershipGroups []string

+ Roles []string

+ Subject string

+ Tenant string

+ ValidUntil time.Time

+ func (f Facts) FlatEntities() ([]Entity, error)

+ func (f Facts) IDsForType(entityType string) ([]EntityID, error)

+ func (f Facts) MarshalJSON() ([]byte, error)

+ type NamedAdministration struct

+ Inventory PolicyInventory

+ Policies *Administration

+ func (s *NamedAdministration) Archive(ctx context.Context, ref NamedReference) (Document, error)

+ func (s *NamedAdministration) Assign(ctx context.Context, asset Resource, expected int64, actions []string, ...) (Document, error)

+ func (s *NamedAdministration) Create(ctx context.Context, id string, definition NamedDefinition) (NamedPolicy, error)

+ func (s *NamedAdministration) Impact(ctx context.Context, resource Resource) ([]NamedImpact, error)

+ func (s *NamedAdministration) List(ctx context.Context) ([]NamedPolicy, error)

+ func (s *NamedAdministration) Update(ctx context.Context, ref NamedReference, definition NamedDefinition) (NamedPolicy, []NamedImpact, error)

+ type NamedDefinition struct

+ Archived bool

+ DisplayName string

+ Policies map[string]Policy

+ func Definition(document Document) (NamedDefinition, error)

+ func (d NamedDefinition) Validate() error

+ type NamedDependency struct

+ Resource Resource

+ Revision int64

+ type NamedImpact struct

+ Actions []string

+ Resource Resource

+ Revision int64

+ type NamedPolicy struct

+ DisplayName string

+ Policies map[string]Policy

+ Resource Resource

+ Revision int64

+ type NamedReference struct

+ Resource Resource

+ Revision int64

+ func (r NamedReference) Valid() bool

+ type Policy struct

+ Definition *NamedDefinition

+ EntityType string

+ Mode string

+ Named *NamedReference

+ Priority int

+ RequiredScopes []string

+ Rule *Rule

+ func PolicyForAction(policies map[string]Policy, action string) (Policy, bool)

+ type PolicyChoiceBinding struct

+ Choices Choices

+ Resource Resource

+ type PolicyInventory interface

+ PolicyResources func(context.Context, string) ([]Resource, error)

+ type PreparedFacts struct

+ func PrepareFacts(facts Facts) *PreparedFacts

+ func (p *PreparedFacts) Facts() Facts

+ func (p *PreparedFacts) HasExposureLiteral(value string) bool

+ func (p *PreparedFacts) HasGroup(value string) bool

+ func (p *PreparedFacts) HasRoleLiteral(value string) bool

+ type Provider interface

+ Resolve func(context.Context) (Facts, error)

+ type Request struct

+ Action string

+ Resource Resource

+ Selection *[]Entity

+ type Resource struct

+ ID string

+ Kind string

+ Tenant string

+ Version string

+ type ResourceFamily struct

+ ID string

+ Kind string

+ Tenant string

+ type RevisionSelection struct

+ Policy Policy

+ PolicyRevision int64

+ Version string

+ type Rule struct

+ Entity *Entity

+ Kind string

+ Rules []Rule

+ Value string

+ type SelectedResource struct

+ Decision Decision

+ MappingRevision int64

+ PolicyRevision int64

+ Resource Resource

+ type SelectedScopeDecision struct

+ Entities []Entity

+ ValidUntil time.Time

+ type SelectedScopeProvider interface

+ ResolveSelectedScope func(context.Context, Request, Document, Facts) (SelectedScopeDecision, error)

+ type SelectionDocument struct

+ Action string

+ DefaultVersion string

+ Overrides []VersionOverride

+ Resource ResourceFamily

+ Revision int64

+ Revisions []RevisionSelection

+ type SelectionRequest struct

+ Action string

+ Resource ResourceFamily

+ Selection *[]Entity

+ type SelectionStore interface

+ GetSelection func(context.Context, ResourceFamily) (SelectionDocument, error)

+ type Selector struct

+ Mappings SelectionStore

+ Service *Service

+ func (s *Selector) Authorize(ctx context.Context, request SelectionRequest) (SelectedResource, error)

+ func (s *Selector) FindPolicy(ctx context.Context, resource ResourceFamily) (SelectedResource, Document, error)

+ type Service struct

+ Decisions DecisionProvider

+ Directory Directory

+ Provider Provider

+ SelectedScopes SelectedScopeProvider

+ Store Store

+ func (s *Service) Authorize(ctx context.Context, request Request) (Decision, error)

+ func (s *Service) AuthorizeSelectionWithStatus(ctx context.Context, request Request, selected []Entity) (Decision, Facts, int64, error)

+ func (s *Service) AuthorizeWithFacts(ctx context.Context, request Request) (Decision, Facts, error)

+ func (s *Service) AuthorizeWithRevision(ctx context.Context, request Request) (Decision, Facts, int64, error)

+ func (s *Service) AuthorizeWithStatus(ctx context.Context, request Request) (Decision, Facts, int64, error)

+ func (s *Service) EditorContext(ctx context.Context, r Resource) (EditorContext, error)

+ func (s *Service) EditorContextWithStatus(ctx context.Context, r Resource) (EditorContext, error)

+ func (s *Service) Get(ctx context.Context, resource Resource) (Document, error)

+ func (s *Service) GetWithStatus(ctx context.Context, resource Resource) (Document, error)

+ func (s *Service) Replace(ctx context.Context, candidate Document) (Document, error)

+ type StaticDirectory struct

+ func NewStaticDirectory(bindings []PolicyChoiceBinding, access *Service) (*StaticDirectory, error)

+ func (d *StaticDirectory) Choices(ctx context.Context, resource Resource, expected Facts) (Choices, error)

+ type StaticSelectionStore struct

+ func NewStaticSelectionStore(documents []SelectionDocument) (*StaticSelectionStore, error)

+ func (s *StaticSelectionStore) GetSelection(ctx context.Context, resource ResourceFamily) (SelectionDocument, error)

+ type StaticStore struct

+ func NewStaticStore(documents []Document) (*StaticStore, error)

+ func (*StaticStore) Replace(context.Context, Document, int64, string) (Document, error)

+ func (s *StaticStore) Get(ctx context.Context, resource Resource) (Document, error)

+ type Store interface

+ Get func(context.Context, Resource) (Document, error)

+ Replace func(context.Context, Document, int64, string) (Document, error)

+ type VersionOverride struct

+ Priority int

+ RequiredExposures []string

+ Version string