ReBAC engine with declarative policies, graph evaluation, and sub-millisecond latency
Important
Under active development. Not production-ready.
Inspired by Google Zanzibar. AuthZEN compliant.
git clone https://github.com/inferadb/engine && cd engine
mise trust && mise install
cargo run --bin inferadb-engineCheck a permission:
curl -X POST http://localhost:8080/v1/evaluate \
-H "Content-Type: application/json" \
-d '{"evaluations": [{"subject": "user:alice", "resource": "doc:readme", "permission": "viewer"}]}'| Feature | Description |
|---|---|
| Complete API | Check, Expand, ListResources, ListSubjects, Watch |
| Multi-Tenant | Data isolation via Organizations and Vaults |
| Wildcards | Model public resources with user:* |
| Observable | Prometheus, OpenTelemetry, structured logs |
| Storage | Memory (dev) or Ledger (prod) |
| Extensible | WASM modules for custom logic |
graph TD
Bin[inferadb-engine] --> API[inferadb-engine-api]
API --> Core[inferadb-engine-core]
API --> Auth[inferadb-engine-auth]
Core --> Repo[inferadb-engine-repository]
Core --> Cache[inferadb-engine-cache]
Repo --> Store[inferadb-engine-store]
Store --> Memory[(Memory)]
Store --> Ledger[(InferaDB Ledger)]
| Crate | Purpose |
|---|---|
| inferadb-engine | Binary entrypoint |
| inferadb-engine-api | REST and gRPC endpoints |
| inferadb-engine-core | Permission evaluation, IPL parser |
| inferadb-engine-auth | JWT validation, JWKS, OAuth |
| inferadb-engine-repository | Domain repositories |
| inferadb-engine-store | Storage trait definitions |
| inferadb-engine-cache | Result caching |
| inferadb-engine-config | Configuration and secrets |
| inferadb-engine-types | Shared type definitions |
| inferadb-engine-const | Shared constants |
| inferadb-engine-observe | Metrics, tracing, logging |
| inferadb-engine-wasm | WebAssembly sandbox |
Configure via config.yaml or environment variables (INFERADB__ENGINE__ prefix):
engine:
listen:
http: "127.0.0.1:8080"
grpc: "127.0.0.1:8081"
storage: "ledger" # or "memory" for dev
ledger:
endpoint: "http://ledger.inferadb:50051"
client_id: "engine-prod-001"
namespace_id: 1
cache:
enabled: true
capacity: 100000
ttl: 300just test # Standard tests
just lint # Clippy
just fmt # FormatSee just --list for all commands and CONTRIBUTING.md for guidelines.
Dual-licensed under MIT or Apache 2.0.