Auth0
Who are you, and did you approve?
- User authentication (passkeys, SSO, org login)
- Agent & application authentication
- Sessions and access tokens
- MFA and step-up authentication
- CIBA / out-of-band transaction approval
Auth0 answers: did the appropriate human successfully authenticate and approve this high-risk action?
Application
What is this transaction?
- Products, inventory, and pricing
- Cart contents and order totals
- Customer profiles and payment execution
- Fraud and risk scoring
- Threshold decision: order >= $5,000 requires CIBA
These are business facts. They belong in the app database — never as FGA tuples.
OpenFGA
May this subject act on this resource?
- Organization membership, admins, purchasers, approvers
- Agent registration and the authorized_agent kill switch
- Delegation to payment methods and cost centers
- Assignment and per-transaction approval on orders
- Final decisions: can_use, can_charge, can_purchase
FGA answers: given that approval, is this particular agent actually authorized to execute this action on this resource?
One purchase, three owners
The agent asks to buy server order 1002 for Smith Computer Store.
Application
Order total $12,000 >= $5,000 — CIBA required
Auth0
Approval request sent; user:mike approves
Application
Records the transaction approval
OpenFGA
shopping_agent AND approved_agent AND authorized_agent → ALLOW
Keep in the application database
- Order total
- SKU and product price
- Inventory
- Shipping address
- Payment transaction
- Fraud score
Keep in OpenFGA
- Who belongs to the organization
- Who administers the organization
- Which agent is registered
- Which agent is currently authorized
- Which payment method an agent may use
- Which cost center an agent may charge
- Which order an agent is assigned to
- Whether the agent has transaction approval
Without FGA, these authorization facts live in app-specific tables and conditional code. With FGA, one centralized policy serves every surface.
One question, every surface
Web Store · Mobile App · Procurement API · AI Agent · MCP Server all ask the same centralized question:
Can agent:smith-procurement-agent perform can_purchase_by_agent on order:laptop-order-1001?
Auth0 establishes identity and performs strong authentication. The application understands the business transaction. OpenFGA determines whether that identity is authorized to act on that resource. And for agents: an agent can retain every role and assignment, while one organization-level authorization relationship acts as a centralized kill switch that prevents every downstream action.