# Apache Casbin

> Apache-2.0 authorization library: ACL, RBAC, ABAC

**Category:** Libraries  
**Pricing:** open-source  
**URL:** https://casbin.apache.org  
**GitHub:** https://github.com/apache/casbin  
**Added:** 2026-10-18

---

## The Hook

Apache Casbin is an access-control library that enforces authorization from a model file and a policy store, supporting ACL, RBAC, ABAC and more, with production-ready implementations in many languages.

## What's Good

Apache-2.0 (apache/casbin), release v3.11.0 (2026-08-20). The Go library is the reference; jCasbin, node-Casbin, PHP-Casbin, PyCasbin, Casbin.NET, Casbin-CPP and Casbin-RS are listed as production-ready. Policies persist through adapters for most databases, watchers keep instances in sync, and an online editor helps you test models. Now part of the Apache Software Foundation. ★~20.5k.

## The Catch

The model file syntax (request, policy, matchers) takes time to learn, and mistakes are security bugs. Large policy sets need care for performance. It decides access; it does not handle authentication or user management.

## Verdict

A proven authorization engine for when roles in a column are not enough.