The Architecture

Core Principles

Fortress reimagines authorization by strictly separating Identity, Tenancy, and Authorization into distinct logical layers.

🔄

Grants-First Model

Permissions are never assigned to users. Every Principal receives a singleton group, ensuring all grants flow through a uniform Group-based evaluation engine.

🛡️

DENY-First Security

Explicit denials always override allows at the same or higher specificity. This fail-secure approach is critical for regulatory compliance.

📂

Path-Based Tags

Resources are addressed via canonical paths (e.g., /org/acme/ns_main/api), allowing for intuitive inheritance and global wildcard policies.

1. Identity & Realms

Realms act as identity boundaries for different populations. A Principal belongs to exactly one Realm but can hold multiple credentials (SSO, Password, API Keys).

Realms vs. Authentication

Realms separate populations (Employees vs. Customers), while Credentials define how they prove who they are.

Realm Feature	Function	Typical Metadata
Federation	OIDC/SAML mapping.	`idp_url`, `attribute_mapping`.
Security	Environment restrictions.	`ip_allowlist`, `geo_restrictions`.
Lifecycle	Account maintenance.	`auto_suspend_days`, `annual_review`.

2. Tenancy Isolation

The Tenancy layer manages resource boundaries across Organizations and Namespaces.

Organizations (Orgs)

The primary tenant unit for business or legal separation.

Namespaces

Logical subdivisions within an Org. Every Org is provisioned with ns_main by default.

Realm

Organization

Namespace (ns_main)

3. Authorization Engine

Authorization is determined by the intersection of Groups, Roles, and Grants.

Flattening: Expand all Roles assigned to the user's Groups into atomic permissions.

Sort: Order by path specificity (deepest tag segment wins).

Resolve: Apply DENY override and evaluate runtime metadata conditions (Time/IP).

JSONB Grant Metadata Example

{
   "conditions": {
      "ip_cidr": "10.0.0.0/8",
      "time_window": "09:00-17:00",
      "mfa_required": true
   },
   "labels": ["soc2_regulated"]
}