Skip to main content
Alfiz is scoped permissions for TypeScript applications. You declare a permission catalog, every permission key and every scope type, in the codebase that enforces it. Every can() check runs in-process against your own database. Nothing Alfiz operates is on your request path.

Quickstart

Install Alfiz and write your first permission check in minutes

Core Concepts

Understand grants, scopes, subjects, and the catalog

API Reference

Full reference for every Client and Application method

Static Verification

Run alfiz-verify to catch ungated surfaces at build time

​
Is Alfiz for you?

What qualifies you is the shape of your problem, not the size of your company. It fits if you recognize one of these: If a single role column is genuinely enough for your application, it will stay enough, and Alfiz is more machinery than you need.

​
Four commitments

Declared in code

Your permission catalog is TypeScript, declared in the codebase that enforces it. There is no second list in a dashboard to drift out of sync with it.

Checked in your own process

can() runs in-process against your own database. Nothing Alfiz operates is on your request path, so nothing it does can slow or stop a check.

Typed end to end

Keys and patterns are template-literal types derived from your catalog. An unknown permission key is a compile error rather than a silent false.

Verified in CI

alfiz-verify proves the two directions match: nothing is enforced that isn’t declared, and the build warns on anything declared that no gate references.
Grants nest rather than fan out: a grant made at an enclosing scope covers everything within it, resolved by walking up ancestors at check time. See Scopes and hierarchy.

​
Get started

1

Install packages

2

Define your catalog

Declare namespaces, permissions, and scope types in a single TypeScript module. See the Catalog overview to learn the shape.
3

Create the application and client

Wire a storage driver and ancestry resolver, then call createAlfizClient. The Quickstart walks through this end-to-end.
4

Run your first check

Every check is typed against your catalog, so unknown keys are compile errors.

​
Packages

The packages above are complete on their own. Groups, roles, reporting hierarchy, access requests, approvals, sessions, and permission metrics all run against your own database with no external dependency. Alfiz Cloud adds hosted administration and cross-application federation when you want them, and is never required.
Check volume is not a billing dimension and will not become one. Alfiz Cloud bills for the work it performs: admin seats, federated applications, connectors, retained audit volume. See Metering and caps.