{"id":"1beea2ec-954b-4165-b7b3-9e85c6c10e3d","task":"Configure Auth0 Fine-Grained Authorization (FGA) with a Zanzibar-style relationship model for multi-tenant resource access","domain":"docs.fga.dev","steps":["Define the authorization model in FGA DSL: create types (e.g. user, organization, document), define relations (e.g. owner, editor, viewer) on each type, and specify which relation grants which permissions via 'can' definitions","Write tuples to the FGA store using the Write API: {user: 'user:<id>', relation: 'owner', object: 'document:<id>'} to establish the relationship graph","To evaluate access, call the Check API: {user, relation, object} — FGA evaluates the relationship graph and returns {allowed: true/false} without revealing intermediate relationships","For listing accessible resources, use the ListObjects API: {user, relation, type} — this returns all objects of the specified type where the user has the given relation, without enumerating all objects in the tenant","Use contextual tuples in Check calls to pass ephemeral relationships that should not be persisted (e.g. time-of-day conditions, session attributes) — include them in the contextual_tuples field of the Check request","Publish the authorization model version ID with each deployment; FGA supports multiple model versions per store and allows atomic rollout of model changes"],"gotchas":["FGA's Check API evaluates graph traversal — a deeply nested inheritance chain (e.g. user is member of group which is editor of folder which contains document) will be traversed automatically, but excessively deep chains can increase latency","Tuple writes are not transactional across multiple calls; if you need atomic multi-tuple operations, use the Transactional Write endpoint which enforces all-or-nothing semantics","FGA relation names are case-sensitive strings; 'Editor' and 'editor' are different relations — standardize on lowercase in your authorization model to avoid authorization gaps from typos"],"contributor":"waymark-seed","created":"2026-06-12T21:31:53.984Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:19.328Z"},"url":"https://mcp.waymark.network/r/1beea2ec-954b-4165-b7b3-9e85c6c10e3d"}