Introduction

zynactra/access answers one question for every request a product serves: may this person do this to this record? Products declare what can be done in manifests. Admins decide who can do it, and where, with roles and assignments. Cerbos makes every decision from policies generated out of the manifests.

 manifests (access.yaml)  --zaccess gen-->  Cerbos policies + schemas + access.manifest.json + constants
                                                         |
 request --> your auth --> Subject --> guard --> record check / list plan --> Cerbos sidecar
                                         \-- grants from Postgres (access schema), cached, NOTIFY-invalidated

What it gives a product

• Permissions as code. leave.request:approve is declared once in a manifest with the scopes it may be granted at and any condition ("only pending requests, never your own"). zaccess gen turns that into Cerbos policies, JSON schemas and typed constants. Nobody writes Cerbos YAML.
• Scopes that match how organisations work. global, self, reporting lines (/ceo/mgr/emp/) and sets such as org units with everything below them.
• Three checks per endpoint. A route guard, a record check, and for lists a SQL filter generated from a Cerbos query plan, so pagination and counts are right. Strict mode fails routes that forget the record check.
• Field-level and sensitive permissions. leave.request:read:reason is its own permission; granting a sensitive one everywhere needs a reason and lands in the audit trail.
• Org rules. One client wants "only the executive sees executive salaries"? An org rule narrows the product's policy for that org alone, with no code change.
• Administration that can't be abused. Custom roles, time-boxed assignments, IdP group mappings, break-glass, an append-only change log and "explain this decision". Nobody can grant more than they hold, assign themselves, or remove the last admin.
• React. useCan, <Can> and ready-made admin screens on @zynactra/ui.
• The same contracts in Go and TypeScript, pinned by shared conformance fixtures, so a Go service and a Nest service of the same product decide identically.

The admin screens above are the real @zynactra/access-react/admin, running against an in-memory API.

Packages

The four npm packages and the Go module share one version.

Where to start