Authorization architecture

Smith Computer Store — who decides what, and why

Open the live demo

Auth0

Who are you, and did you approve?

  • User authentication (passkeys, SSO, org login)
  • Agent & application authentication
  • Sessions and access tokens
  • MFA and step-up authentication
  • CIBA / out-of-band transaction approval

Auth0 answers: did the appropriate human successfully authenticate and approve this high-risk action?

Application

What is this transaction?

  • Products, inventory, and pricing
  • Cart contents and order totals
  • Customer profiles and payment execution
  • Fraud and risk scoring
  • Threshold decision: order >= $5,000 requires CIBA

These are business facts. They belong in the app database — never as FGA tuples.

OpenFGA

May this subject act on this resource?

  • Organization membership, admins, purchasers, approvers
  • Agent registration and the authorized_agent kill switch
  • Delegation to payment methods and cost centers
  • Assignment and per-transaction approval on orders
  • Final decisions: can_use, can_charge, can_purchase

FGA answers: given that approval, is this particular agent actually authorized to execute this action on this resource?

One purchase, three owners

The agent asks to buy server order 1002 for Smith Computer Store.

Application

Order total $12,000 >= $5,000 — CIBA required

Auth0

Approval request sent; user:mike approves

Application

Records the transaction approval

OpenFGA

shopping_agent AND approved_agent AND authorized_agent → ALLOW

Keep in the application database

  • Order total
  • SKU and product price
  • Inventory
  • Shipping address
  • Payment transaction
  • Fraud score

Keep in OpenFGA

  • Who belongs to the organization
  • Who administers the organization
  • Which agent is registered
  • Which agent is currently authorized
  • Which payment method an agent may use
  • Which cost center an agent may charge
  • Which order an agent is assigned to
  • Whether the agent has transaction approval

Without FGA, these authorization facts live in app-specific tables and conditional code. With FGA, one centralized policy serves every surface.

One question, every surface

Web Store · Mobile App · Procurement API · AI Agent · MCP Server all ask the same centralized question:

Can agent:smith-procurement-agent perform can_purchase_by_agent on order:laptop-order-1001?

Auth0 establishes identity and performs strong authentication. The application understands the business transaction. OpenFGA determines whether that identity is authorized to act on that resource. And for agents: an agent can retain every role and assignment, while one organization-level authorization relationship acts as a centralized kill switch that prevents every downstream action.