Ir al contenido principal

Supported Models

Casbin supports the following access control models and patterns. If you are not sure which one you need, start with Choosing an access control model.

  1. ACL (Lista de Control de Acceso)
  2. ACL con superusuario
  3. ACL without users — For systems without authentication or user identity (e.g. API-only or device access).
  4. ACL without resources — When permissions apply to resource types rather than specific instances (e.g. "write-article", "read-log").
  5. RBAC (Control de Acceso Basado en Roles)
  6. RBAC with resource roles — Both users and resources can have roles (or group memberships).
  7. RBAC with domains/tenants — Users can have different roles in different domains or tenants.
  8. ABAC (Attribute-Based Access Control) — Uses attributes (e.g. resource.Owner) in rules.
  9. PBAC (Policy-Based Access Control) — Authorization is driven by rule-based policies for dynamic, context-aware decisions.
  10. BLP (Bell–LaPadula) — Formal model with security labels and clearances.
  11. Biba — Integrity model that restricts information flow to prevent unauthorized changes.
  12. LBAC (Lattice-Based Access Control) — Combines confidentiality and integrity in a lattice-based framework.
  13. OrBAC (Organisation-Based Access Control) — RBAC extended with abstraction layers for multi-organization policies.
  14. UCON (Usage Control) — Covers ongoing authorization, mutable attributes, obligations, and conditions.
  15. RESTful — Path patterns (e.g. /res/*, /res/:id) and HTTP methods (GET, POST, PUT, DELETE).
  16. IP Match — Match by IP address or CIDR for network-level control.
  17. Deny-override — Both allow and deny policies; deny overrides allow.
  18. Priority — Policy rules are ordered (e.g. like firewall rules); first match wins.

Ejemplos​

ModeloArchivo de modeloArchivo de política
ACLbasic_model.confbasic_policy.csv
ACL con superusuariobasic_with_root_model.confbasic_policy.csv
ACL sin usuariosbasic_without_users_model.confbasic_without_users_policy.csv
ACL sin recursosbasic_without_resources_model.confbasic_without_resources_policy.csv
RBACrbac_model.confrbac_policy.csv
RBAC con roles de recursorbac_with_resource_roles_model.confrbac_with_resource_roles_policy.csv
RBAC con dominios/tenantsrbac_with_domains_model.confrbac_with_domains_policy.csv
ReBACrebac_model.confrebac_policy.csv
ABACabac_model.confN/A
BLPblp_model.confN/A
Bibabiba_model.confN/A
LBAClbac_model.confN/A
OrBACorbac_model.conforbac_policy.csv
IP Matchipmatch_model.confipmatch_policy.csv
RESTfulkeymatch_model.confkeymatch_policy.csv
Denegación sobre permisorbac_with_not_deny_model.confrbac_with_deny_policy.csv
Permitir y denegarrbac_with_deny_model.confrbac_with_deny_policy.csv
Prioridadpriority_model.confpriority_policy.csv
Prioridad Explícitapriority_model_explicitpriority_policy_explicit.csv
Prioridad del Sujetosubject_priority_model.confsubject_priority_policyl.csv

Comments are powered by giscus and GitHub Discussions. They load from giscus.app and GitHub only after you click the button below.