Member-only story
RBAC in Go — From a Hand-Rolled Approach to Casbin
From simple role checks to policy-driven authorization — and knowing when each one is enough.
Authentication answers one question: who are you? Part 1 through 3 solved that completely — we can hash passwords, issue JWTs, and protect routes behind middleware.
But there’s a second question that authentication never answers: what are you allowed to do?
A logged-in user is not automatically allowed to do everything. An editor shouldn’t delete other users’ posts. A viewer shouldn’t change billing settings. A support agent shouldn’t access raw database exports. This is authorization — and Role-Based Access Control (RBAC) is the most practical model for implementing it.
The idea is simple: instead of assigning permissions directly to individual users (which gets unmanageable fast), you assign permissions to roles, then assign roles to users. Change what the editor role can do, and every editor in your system is updated instantly.
In this part, we’ll build RBAC in two stages — a lightweight hand-rolled approach for simple apps, then Casbin for when your policy complexity outgrows what a few if statements can handle.
