Fine-grained access control

In addition to general API authentication via the bearer token, the JLINC server endpoints all support fine-grained access control via AuthZEN formatted requests. This means the JLINC server can return a denial if a user, AI tool, or system element does not have required permissions to complete the activity.

To use authorization, the JLINC server supports Cerbos for fine-grained access control, either via their cloud SaaS, or self-hosted alongside the JLINC server. Once the AuthZEN spec is approved, any and all PDPs supporting AuthZEN will be compatible. An example deployment of Cerbos is provided in the JLINC server repo's compose file. Sample Cerbos policies can also be found in the policies folder of the repo.

AuthZen can also be used in LangChain implementations of JLINC.

To retrieve add an authentication check to an existing API call, simply add an auth key. For example, to ensure the current user can retrieve data using the policy defined for data on type user:

const data = (await axios.post(
    `https://api-test.jlinc.io/api/v1/data/event/get`,
    {
        eventId: userEvent.created.eventId,
    },
    auth: {
        subject: {
            type: "user",
            id: "myuser",
        },
        action: {
            name: "read",
        },
        resource: {
            type: "data",
            id: "<random id>",
            properties: {
                ownerID: "<optional data owner>",
            }
        }
    },
    {
        headers: {
            'Authorization': `Bearer ${token}`,
        }
    },
)).data;

If the operation is allowed within the policy, the normal data return will occur. If not, an AuthZEN response of { decision: false } will be returned.

Fine-grained authorization can also be checked without executing an event via the auth endpoint:

const authResult = (await axios.post(
    `https://api-test.jlinc.io/api/v1/auth`,
    {
        subject: {
            type: "user",
            id: "myuser",
        },
        action: {
            name: "read",
        },
        resource: {
            type: "data",
            id: "<random id>",
            properties: {
                ownerID: "<optional data owner>",
            }
        }
    },
    {
        headers: {
            'Authorization': `Bearer ${token}`,
        }
    },
)).data;

If the operation is allowed within the policy, an AuthZEN response of { decision: true } will be returned. If not, an AuthZEN response of { decision: false } will be returned.