2024 was the year AI agents moved from demos to production. The Model Context Protocol (MCP) has been adopted by Google, OpenAI, Microsoft, and many others, and the way applications talk to external services is changing. That shift brings a new set of authorization challenges we at Casbin have been working on.
This post explains how to design and implement RBAC with the Casbin library. For SaaS platforms with resource hierarchies and roles that inherit permissions, Casbin is a performant option.
Apache APISIX can enforce Casbin authorization policies at the gateway with its built-in authz-casbin plugin. The plugin uses Lua Casbin and supports access control models such as ACL, RBAC, and ABAC.
This guide puts a small RBAC policy on the APISIX request path. You will verify allowed and denied requests, then update a shared policy through plugin metadata without changing the route.
The Casbin community originally proposed the integration in APISIX Issue #4674, and APISIX PR #4710 added the plugin.
This guide was refreshed in August 2026. The examples were validated with Apache APISIX 3.17.0. The original 2021 author remains credited, and Yilia Lin is added for the 2026 refresh.
We are pleased to announce that Casbin’s founder, Yang Luo, was named a Google Open Source Peer Bonus winner for his work on Casbin, Npcap, and Nmap in 2019 Q3.
We have moved Casbin’s documentation from GitHub Wiki to the Docs section of this site, powered by Docusaurus. You get better Markdown rendering, full-text search, versioning, and translation.
We have ported Casbin to Node.js: node-Casbin.
People often ask whether Casbin can run as a service instead of a library. The answer is yes. We have launched Casbin Server as a concrete Access Control as a Service solution.