Model WorkOS Fine-Grained Authorization with resource types, register resource instances, assign roles, and run permission checks

Documented steps

1. In the WorkOS Dashboard under Authorization > Resource Types, define the hierarchy (for example organization as implicit root, then workspace, then project) giving each type a name, slug, and allowed parent type(s). Resource types are Dashboard-only — there is no public API for schema management.
2. Under Authorization > Permissions, define permissions using a {resource_type}:{action} slug convention, e.g. project:edit, workspace:view.
3. Under Authorization > Roles, create roles scoped to a resource type and attach permissions. A role may include permissions on child resource types so access flows down the hierarchy (e.g. workspace-admin granting project:edit).
4. Register each resource instance as your app creates it: POST https://api.workos.com/authorization/resources with 'Authorization: Bearer sk_...' and body {"resource_type_slug":"workspace","external_id":"workspace_01H","organization_id":"org_...","name":"Engineering"}. For nested resources add parent_resource_id, or parent_resource_type_slug plus parent_resource_external_id.
5. Grant access: POST https://api.workos.com/authorization/organization_memberships/{organization_membership_id}/role_assignments with body {"role_slug":"workspace-admin","resource_id":"authz_resource_..."} (or resource_external_id plus resource_type_slug instead of resource_id).
6. Audit who has access: GET https://api.workos.com/authorization/resources/{resource_id}/role_assignments.
7. Authorize an action at request time: POST https://api.workos.com/authorization/organization_memberships/{organization_membership_id}/check with body {"permission_slug":"project:edit","resource_id":"authz_resource_..."}. The response is {"authorized": true|false} and accounts for direct assignments, inherited parent-resource roles, and org-scoped roles.
8. Issue one check call per (permission, resource) pair — the current live reference documents only the single-check endpoint.
9. Revoke access: DELETE https://api.workos.com/authorization/organization_memberships/{organization_membership_id}/role_assignments/{role_assignment_id}, or by role_slug plus resource in the request body.
10. Fail closed in your application: treat any non-200 or ambiguous response from /check as denied rather than allowing the action.
11. Reference: https://workos.com/docs/fga