OpenFGA-based authorization - basic #1563

Activity

1. Taahir Ahmed (ahmedtd)

   added this to the M3 milestone on Sep 9, 2026
2. Taahir Ahmed (ahmedtd)

   assigned

   Shruti Nair (SHRUTI6991)

   on Sep 9, 2026
3. Taahir Ahmed (ahmedtd)

   added

   area/identity

   on Sep 9, 2026
4. Taahir Ahmed (ahmedtd)

   added the

   Feature

   issue type on Sep 9, 2026
5. Aditya Shantanu (aditya-shantanu)

   added

   kind/featureAn enhancement / feature request or implementationAn enhancement / feature request or implementation

   area/securitySecurity related issue/prSecurity related issue/pr

   on Sep 9, 2026
6. Taahir Ahmed (ahmedtd)

   added a commit that references this issue on Sep 11, 2026

   feat(authz): define 3-tier atespace authorization model and node rest…

   ...

   6725335
7. Zheng Lammerts (zlammerts-svg)

   added this to Substrate Milestones (go/substrate-milestones)on Sep 17, 2026
8. github-project-automation

   moved this to Todo in Substrate Milestones (go/substrate-milestones)on Sep 17, 2026
9. Shruti Nair (SHRUTI6991)

   added sub-issues on Sep 17, 2026

   • Model Tags and fail close all client facing APIs in OpenFGA #1696
   • Bootstrap Cluster Admin #1697
   • Runtime Authorization Check in Atespace #1698
   • Runtime authorization check for Actor and ActorTemplate #1699
   • Runtime Authorization check for all other ate api resources #1700
   • Implement the Policy Governance API #1701
10. 14 remaining items

    Load more
11. ktsoator (ktsoator)

    added a commit that references this issue on Oct 13, 2026

    ateapi: [Part 3] authorize actor lifecycle, egress policy, and worker…

    ...

    f03327b
12. Shruti Nair (SHRUTI6991)

    added a sub-issue on Oct 13, 2026

    • Enable cache for OpenFGA Server per ate api replica #2578
13. Shruti Nair (SHRUTI6991)

    removed sub-issues on Oct 13, 2026

    • Stop identity collisions and stop a JWT impersonating system components or bootstrap owners #2187
    • Benchmark the hot path #2202
    • [Tech debt] Store structural links during creation of resource instead of contextually via contextual tuples. #2312
    • Enable cache for OpenFGA Server per ate api replica #2578
14. Shrutiya Mohan (shrutiyam-glitch)

    added a commit that references this issue on Oct 14, 2026

    ateapi: grant system component roles to Substrate's own components (a…

    ...

    e8808e0
15. Tim Hockin (thockin)

    added a commit that references this issue on Oct 14, 2026

    ateapi: [Part 4] deny RPCs without an authz rule and authorize tags (a…

    ...

    45c25ef
16. SHRUTI6991 commented on Oct 16, 2026

    

    Shruti Nair (SHRUTI6991)

    on Oct 16, 2026

    Collaborator

    More actions

    Authorization is being enforced now. Closing this Feature.
17. Shruti Nair (SHRUTI6991)

    closed this as completedon Oct 16, 2026
18. github-project-automation

    moved this from In Progress to Done in Substrate Milestones (go/substrate-milestones)on Oct 16, 2026
19. Michelle Au (msau42)

    added a commit that references this issue on Oct 16, 2026

    ate-setup: enforce ateapi authorization by default and manage access …

    ...

    c4518a1
20. zlammerts-svg commented on Oct 16, 2026

    

    Zheng Lammerts (zlammerts-svg)

    on Oct 16, 2026

    Collaborator

    More actions

    Thank you Shruti Nair (@SHRUTI6991) and Taahir Ahmed (@ahmedtd) for all your work!
21. SHRUTI6991 commented on Oct 16, 2026

    

    Shruti Nair (SHRUTI6991)

    on Oct 16, 2026

    Collaborator

    More actions

    The followup work for atelet authorizer is being tracked under this issue: #1564
22. Shruti Nair (SHRUTI6991)

    added a parent issue on Oct 18, 2026

    • Substrate Authorization Roadmap #2823