CASL CONSULTING / ARCHITECTURE & IMPLEMENTATION

Authorization that grows with your product

From simple permissions to complex authorization architectures.

Get expert guidance from a team combining CASL’s creator with backend and platform expertise — from architecture decisions to production implementation.

Discuss your architecture

Nearly a decade of authorization expertise

Since 2017Open-source development

7M+Monthly npm downloads

7,000+GitHub stars

Built with CASL

CASL & UCAST across the ecosystem

Open Policy Agent — Policy compilation to UCAST
Cerbos — Authorization-aware data filtering
Permit.io — Frontend permission checks
NestJS — Official authorization guide

From authorization policies to database queries

OPA / Rego UCAST Database query filter

Authorization doesn't end at API checks. UCAST enables policy-derived conditions to be translated into database filters.

Authorization becomes architecture

BEFOREScattered checks. Drifting decisions.

Frontendroles.includes('admin')

APIuser.tenantId === tenantId

Servicesroles.includes('admin')

Database queriesWHERE tenant_id = ?

Four independently implemented authorization checks

AFTERDefine once. Apply consistently.

can('update', 'Project', {
  tenantId: user.tenantId
})

Frontend UI visibility ability.can('update', project)

API Request authorization ability.can('update', project)

Services / jobs Operation enforcement ability.can('update', project)

Database queries Accessible records · @casl/prisma accessibleBy(ability, 'update').ofType('Project')

One permission model. Consistent enforcement across your stack

A path from simple claims to relationships

Add precision as your product evolves. Select a stage to explore.

01 / A CAPABILITY

Claims

Start with feature access or simple capabilities expressed as actions.

can('read:project');
can('update:project');
can('manage:workspace');

A stable API for simple permissions, ready to gain resource context when you need it.

02 / ADD A RESOURCE

Actions / Subjects

Give every layer a shared vocabulary: what action, on which resource?

can('read', 'Project');
can('update', 'Project');
can('manage', 'Workspace');

The same capability vocabulary now distinguishes articles, projects, and workspaces.

03 / GROUP PERMISSIONS

RBAC

Map roles to rules once, instead of scattering role checks across features.

can('read', 'Project');
if (user.role === 'projectAdmin') can('update', 'Project');
if (user.role === 'workspaceAdmin') can('manage', 'Workspace');

Roles become bundles of action/resource permissions.

04 / ADD CONTEXT

ABAC

Refine permissions with ownership, tenant identity, or resource state.

can('read', 'Project', { tenantId: user.tenantId });
if (user.role === 'projectAdmin') {
  can('update', 'Project', { tenantId: user.tenantId });
}
if (user.role === 'workspaceAdmin') {
  can('manage', 'Workspace', { tenantId: user.tenantId });
}

Roles can still grant permissions; attributes constrain which records those grants cover.

05 / FOLLOW RELATIONSHIPS

ReBAC

Denormalized SQL relations

Add workspace membership and resource administrator relationships on top of tenant isolation.

can('read', 'Project', {
  tenantId: user.tenantId,
  workspaceMemberIds: { $in: [user.id] }
});

can('update', 'Project', {
  tenantId: user.tenantId,
  projectAdminIds: { $in: [user.id] }
});

can('manage', 'Workspace', {
  tenantId: user.tenantId,
  workspaceAdminIds: { $in: [user.id] }
});

Denormalized: Fast, local permission checks. Requires keeping derived membership attributes synchronized.

Complementary models, not mandatory migrations. RBAC, ABAC, and relationship-derived permissions can coexist.

Expertise where your team needs it

YOU IMPLEMENT

Architecture & Advisory

Specialized guidance for your authorization architecture.

AssessmentArchitecture, risks, policy correctness
System designRoles, attributes, tenants, enforcement
Migration roadmapDiagrams, testing strategy, next steps

A validated authorization model, technical recommendations, and an actionable implementation roadmap.

WE IMPLEMENT

Architecture & Implementation

From architecture decisions to production code.

ArchitectureModel design and enforcement boundaries
IntegrationBackend, frontend, SQL filtering
Testing & rolloutValidation, performance, incremental migration

Authorization architecture implemented, integrated, and validated with your team.

Flexible B2B engagements
Architecture reviews, advisory, and hands-on implementation under a B2B services agreement. Available for scoped projects or ongoing collaboration.

Work directly with experienced engineers

Serhii Stotskyi

Authorization Architecture · CASL & UCAST Creator

Creator and maintainer of CASL and UCAST, with over 18 years of software engineering experience. Specializing in authorization architecture, policy correctness, and maintainable software design.

Experienced backend and platform engineer who has implemented CASL across multiple projects. Combines hands-on authorization experience with expertise in backend architecture, distributed systems, and production infrastructure.

Direct collaboration. From architecture to production code.

Each engagement is led by an experienced engineer, with complementary expertise available when needed.

Let's solve your authorization challenges.

Tell us what you're building, what isn't working, or where your authorization architecture needs to evolve.