Polizy Authorization

Polizy is a Zanzibar-inspired authorization library for TypeScript/Node.js. It uses relationship tuples to define permissions.

When to Apply

Activate this skill when:

• User mentions "polizy", "authorization", "permissions", "access control"
• User asks "who can do what", "can user X do Y"
• User wants RBAC, ReBAC, or Zanzibar-style authorization
• User needs to check, grant, or revoke permissions
• User is implementing team/group-based access
• User is implementing folder/file permission inheritance

Quick Concepts

Route to Specialized Skill

Based on user's task, use the appropriate skill:

Installation & Setup

Use: polizy-setup

• "Add authorization to my project"
• "Install polizy"
• "Set up permissions system"
• First-time setup

Schema Design

Use: polizy-schema

• "Design permissions schema"
• "What relations do I need"
• "Add new relation type"
• Defining or modifying the authorization model

Implementation Patterns

Use: polizy-patterns

• "How do I implement X"
• "Give team access to project"
• "Make files inherit folder permissions"
• "Grant temporary access"
• Any specific authorization scenario

Storage & Persistence

Use: polizy-storage

• "Set up database storage"
• "Use Prisma with polizy"
• "Create custom storage adapter"
• Production deployment

Debugging & Issues

Use: polizy-troubleshooting

• "Permission check not working"
• "User can't access X but should"
• Error messages
• Unexpected authorization behavior

Minimal Example

import { defineSchema, AuthSystem, InMemoryStorageAdapter } from "polizy";

// 1. Define schema
const schema = defineSchema({
  relations: {
    owner: { type: "direct" },
    viewer: { type: "direct" },
  },
  actionToRelations: {
    edit: ["owner"],
    view: ["owner", "viewer"],
  },
});

// 2. Create AuthSystem
const authz = new AuthSystem({
  storage: new InMemoryStorageAdapter(),
  schema,
});

// 3. Grant permission
await authz.allow({
  who: { type: "user", id: "alice" },
  toBe: "owner",
  onWhat: { type: "document", id: "doc1" },
});

// 4. Check permission
const canEdit = await authz.check({
  who: { type: "user", id: "alice" },
  canThey: "edit",
  onWhat: { type: "document", id: "doc1" },
});
// => true

Related Skills

• polizy-setup - Installation and configuration
• polizy-schema - Schema design
• polizy-patterns - Implementation patterns
• polizy-storage - Storage adapters
• polizy-troubleshooting - Debugging