apache/casbin

What is it?

Key features

• 01Supports ACL, RBAC, ABAC, RESTful, deny-override, and priority-based access control models.
• 02Defines access control models in a config file based on the PERM metamodel.
• 03Loads and stores policies through pluggable adapters, such as databases.
• 04Provides management and RBAC APIs for changing permissions at run-time.
• 05Includes built-in matching operators such as keyMatch for resource path patterns.
• 06Offers synchronized enforcer variants for concurrent use.

Use cases

• Adding role-based permission checks to a Go web service or API.
• Enforcing multi-tenant rules where users hold different roles in different tenants.
• Expressing attribute-based rules, such as allowing only a resource's owner to edit it.
• Managing permissions through an admin interface that updates policies at run-time.

Quick start

1. 1

   Install the library with Go modules

   go get github.com/casbin/casbin/v3
2. 2

   Create an enforcer from a model file and a policy file

3. 3

   Call Enforce in your code before each access to check the request

Things to know

• !The Enforcer is not safe for concurrent use, so shared enforcers that change at run-time need the synced variants.
• !The library does not handle authentication or manage users and roles, so your app must provide those.

Topics

FAQ

What is casbin?

Go access control library that enforces ACL, RBAC, and ABAC authorization policies, configured through model and policy files. Apache Casbin is an authorization library for Go projects. It evaluates whether a subject may perform an action on an object, based on an access control model defined in a configuration file and a set of policy rules. Because the model lives in a config file, changing the authorization scheme usually means editing configuration rather than rewriting application code.

Is casbin free to use? What license does it have?

casbin is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.

Is casbin still maintained?

Actively maintained. The last commit to casbin was on Nov 4, 2026.

What can I use casbin for?

Adding role-based permission checks to a Go web service or API. Enforcing multi-tenant rules where users hold different roles in different tenants. Expressing attribute-based rules, such as allowing only a resource's owner to edit it. Managing permissions through an admin interface that updates policies at run-time.

How do I install casbin?

Install the library with Go modules: go get github.com/casbin/casbin/v3 Create an enforcer from a model file and a policy file Call Enforce in your code before each access to check the request

Where can I get casbin?

The source code and installation instructions are on GitHub: https://github.com/apache/casbin