Implementing flexible authorization that grows with your application is difficult. Many products only need authentication early on but eventually require authorization; however, adding complex authorization to a mature, high usage product is even harder. We’re building Warrant to better abstract the complexity of authorization and reduce implementation cost and maintenance drag for engineering teams.
Warrant abstracts your authorization rules and access control logic outside of your application so it isn’t coupled to core business logic. We adopted concepts from Google Zanzibar to make Warrant flexible enough to support any access control model. Authorization rules are easy to enforce in backend and frontend code at runtime through simple API calls. Both developers and non-technical users can modify access rules through our dashboard to change application behavior without needing to change code.
We’re taking a service-driven approach to authorization. As companies get bigger and build out multiple services, authorization logic needs to be re-implemented in the new services or some central service. Whether you’re a small startup with a monolith or a company with many microservices, we think decoupling your authorization and having a dedicated authorization service is the right approach. Check out our demo app (https://github.com/warrant-dev/warrant-demo-app-ts) for an end-to-end example of how to use Warrant.