Introducing: Fine-Grained Access Management
Published: 2024-01-10 16:21:33

---
title: Introducing: Fine-Grained Access Management
published: true
date: 2023-04-27 15:26:44 UTC
tags: 
canonical_url: https://authzed.com/blog/introducing-fine-grained-access-management
---

The systems we build at AuthZed are the direct result of feedback from our community and customers. Because security is the core of our flagship product, SpiceDB, we take feedback on this topic very seriously. We’ve heard you, and today we’re proud to introduce a better way to secure AuthZed customers’ client applications accessing the SpiceDB API: **Fine-Grained Access Management** (FGAM).

It’s part art and part science when deciding to stamp a commercial product as ready for production. We initially launched our commercial products with very basic API key management to gather market feedback and prioritize future development. Thanks to our customers’ input ❤️, it became clear that they needed far more control over what exactly API keys could access in SpiceDB. FGAM is available now for SpiceDB Dedicated and SpiceDB Self-Hosted customers creating Permissions Systems with SpiceDB 1.19.0 or newer. 🚀

![A screenshot of the Authzed Console showing the SpiceDB Permissions System creation page with Fine-Grained Access Management enabled](https://authzed.com/images/create-ps-fgam.png "SpiceDB Permissions System with FGAM enabled")

## Why Fine-Grained Access Management is Important

Mature engineering organizations typically enforce **the principle of least privilege** : each client will have access to the minimum set of APIs needed for it to perform its operations. For example, a client updating a SpiceDB Schema as part of a continuous integration and delivery pipeline would have the minimum required permission of `WriteSchema` while other production services are restricted to common read-only APIs such as `CheckPermission`, `LookupResources`, and `LookupSubjects`.

The benefit here is huge for security: in the event that a bad actor gains access to one of your systems, Fine-Grained Access Management to the SpiceDB API will limit their capabilities.

## FGAM for your FGAM—SpiceDB! 😎

Because SpiceDB itself is designed to provide Fine-Grained Access Management, it was our first choice for securing the SpiceDB API. That’s right, we [eat our own dog food](https://en.wikipedia.org/wiki/Eating_your_own_dog_food): SpiceDB powers **Fine-Grained Access Management (FGAM)** for our customers’ SpiceDB Permissions Systems! 🤯

Using SpiceDB lets us take the principle of least privilege a step further. Fine-Grained Access Management protecting the SpiceDB API would've been enough for most users, but that alone is insufficient for scenarios where users want to also enforce policy based on runtime context. For example, allow API calls only during specific time-frames or from specific IP ranges. You can further limit access by pairing permissions with context. Here are some examples:

- Only allow `CheckPermission` API calls for a specific subject and/or resource type
- Only allow `WriteRelationship` permissions over a subset of Schema relations
- Filter certain elements from a streaming API
- Only allow changes to a restricted subset of a SpiceDB Schema
- Only allow an API call if a `CheckPermission` for a SpiceDB instance returns `allowed` (API meta-permissions! 🤯)

Our solution offers a familiar RBAC-like paradigm seen in cloud providers' IAM products. You can create **Service Accounts** to represent your workloads, **Roles** with permission and conditions to access one or more API methods, and the **Policy** that binds a role to a principal.

![An animation showing the process of creating a Service Account through the AuthZed Console](https://authzed.com/images/create-service-account.gif "Creating a Service Account")

The star of the show is SpiceDB, which allowed us to create a schema that captures all those [IAM concepts](https://authzed.com/blog/google-cloud-iam-modeling/) seamlessly and supports policy conditions with [SpiceDB Caveats](https://authzed.com/blog/caveats/). Caveats are type-safe and compiled at runtime for blazing-fast dynamic enforcement! ⚡

![A screenshot of the AuthZed Console showing the creation of a new Role with permissions and conditions](https://authzed.com/images/role-with-conditions.png "Role Creation")

## Try out FGAM today! ⭐

You can enable FGAM today for new SpiceDB Permissions Systems using SpiceDB v1.19.0 and up. For help getting started, check out the [Fine-Grained Access Management Documentation](https://authzed.com/docs/spicedb-dedicated/fgam). For support, reach out to us on the [AuthZed Discord](http://authzed.com/discord), via a shared Slack channel, or [support@authzed.com](mailto:support@authzed.com).

## Additional Reading

If you’re interested in learning more about SpiceDB and the features that power FGAM, you can read any of the following posts:

- [Fine-Grained Access Management Documentation](https://authzed.com/docs/spicedb-dedicated/fgam)
- [Caveats: A Scalable Solution for Policy - Jimmy Zelinskie](https://authzed.com/blog/caveats/)
- [Top-3 Most Used SpiceDB Caveat Patterns - Víctor Roldán Betancort](https://authzed.com/blog/top-three-caveat-use-cases/)
- [Modeling Google Cloud IAM in SpiceDB - Jake Moshenko](https://authzed.com/blog/google-cloud-iam-modeling/)