One policy for server and browser. Answers that explain themselves.

Answers that explain themselves

Turn a refusal into clear user feedback.

A simple yes or no does not tell the user why they are blocked.

The library returns a Decision object with a reason and the rule that decided. If data is missing, the status is unevaluable and the decision lists exactly which fields to fetch.

access.can(mika, 'listing', 'edit', listing)
// {
//   allowed: true,
//   reason: 'allow',
//   rule: 'seller-edits-own',
// }

Review access changes before you ship

Identify who gains or loses access in your pull request.

A one-line rule edit can widen or narrow access for a whole group, and a line-by-line diff of the JSON does not show who is affected.

The diffMatrix function compares two policy documents. It reports granted and withdrawn permissions and which checks now read different fields of the row.

const diff = diffMatrix(before, after)
diff.version   // { before: 'listings@7', after: 'listings@8' }
diff.unchanged // false
// { kind: 'granted', key: 'listing.reprice', cause: 'allow-branch-added' }
// { kind: 'reads-object', key: 'listing.reprice' }

A security contract you can read

Know exactly what the library prevents and what your app must handle.

Developers need to know where the library ends and their responsibility begins.

The library maps 37 attack classes to CWE and OWASP entries. Some are prevented by the engine, some use provided primitives, and some are listed as your application's job.

Field-level control

Control exactly which fields a user can read or write.

Users may have access to a row but should not be able to change every column.

Use canFields to determine allowed fields for a subject. Use pickAllowedFields to strip unauthorized fields from a submitted write.

type Question = { askedBy: string; body: string; status: string };

const access = policy<{ id: string }, { question: Question }>()
  .for('question', (p) =>
    p
      .allow('update', p.eq('object.askedBy', 'subject.id'))
      .fields(['*', '!status']),
  )
  .build();

const current = { askedBy: 'customer-41', body: 'In stock?', status: 'open' };
const proposed = { body: 'Wingspan in stock?', status: 'locked' };

const decision = access.canFields(
  { id: 'customer-41' },
  'question',
  'update',
  current,
  'write',
  proposed,
);

// The asker may change the body but not the status, so only the body is kept.
const safe = pickAllowedFields(decision, proposed);

Try it with your own policy

Paste your policy and see what it decides.

You can verify your logic without writing and deploying a full update.

The matrix explorer lets you paste your JSON policy and test decisions for any subject. The document is read in your browser and never uploaded.

Integrated with React

Use a provider and hooks to manage access in your components.

npm install @evanion/acl @evanion/react-acl

import { policy } from '@evanion/acl';
import { PolicyProvider, useCan } from '@evanion/react-acl';

type Shopper = { id: string; roles: string[] };
type Listing = { sellerId: string };

const access = policy<Shopper, { listing: Listing }, { listing: 'edit' }>()
  .for('listing', (p) => p.allow('edit', p.eq('object.sellerId', 'subject.id')))
  .build();

function EditButton({ listing }: { listing: Listing }) {
  const decision = useCan('listing', 'edit', listing);
  return decision.allowed ? <button type="button">Edit listing</button> : null;
}

function App({ shopper }: { shopper: Shopper }) {
  return (
    <PolicyProvider access={access} subject={shopper}>
      <EditButton listing={{ sellerId: 'mika' }} />
    </PolicyProvider>
  );
}

Questions

What is this library?

It is a TypeScript authorization library that builds a policy into a JSON document. This allows the same synchronous checks to run on both your server and in the browser.

Does it need a service of its own?

No. It is a library with zero dependencies. You install it via npm and run it within your own application process.

Can I trust the browser check?

No. Browser checks are advisory and used to update the UI. You must re-decide every request on your server or gateway to ensure security.

What happens when the row is not loaded?

The library returns an unevaluable decision. The result is allowed: false, and the missing field lists the data needed to make a final decision.

Does it work with React?

Yes. The @evanion/react-acl package provides a PolicyProvider and a useCan hook to check permissions inside your components.

How do I notice changes when another service publishes new rules?

Use contractDrift from @evanion/acl/testing. It replays your own questions against the contract you pinned and the one CI fetched, then reports what moved between them.