Authorization

This section covers the authorization mechanisms used in Platform-Mesh, including Relationship-Based Access Control (ReBAC) powered by OpenFGA.

kcp Authorizer Order

The authorization webhook runs after kcp's built-in authorizers. Since no --authorization-order flag is set in the platform-mesh configuration, kcp uses its default authorizer order:

1. AlwaysAllowGroups
2. AlwaysAllowPaths
3. RBAC chain
   1. RequiredGroupsAuthorizer
   2. WorkspaceContentAuthorizer
   3. SystemCRDAuthorizer
   4. MaximalPermissionPolicyAuthorizer
   5. RBAC union
      1. BootstrapPolicyAuthorizer
      2. LocalRBACAuthorizer
      3. GlobalRBACAuthorizer
4. Webhook ← ReBAC authorization happens here

The ReBAC Authorization Webhook is the final authorizer in the chain. If a request is not allowed by any of the preceding authorizers, it will be evaluated by the webhook against OpenFGA.