> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alfiz.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Alfiz: Scoped Permissions for TypeScript Applications

> Scoped permissions for TypeScript applications: declare your catalog in code, verify it in CI, and check it in your own process against your own database.

Alfiz is scoped permissions for TypeScript applications. You declare a permission catalog, every permission key and every scope type, in the codebase that enforces it. Every `can()` check runs in-process against your own database. Nothing Alfiz operates is on your request path.

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Install Alfiz and write your first permission check in minutes
  </Card>

  <Card title="Core Concepts" icon="lightbulb" href="/core-concepts">
    Understand grants, scopes, subjects, and the catalog
  </Card>

  <Card title="API Reference" icon="code" href="/api/create-alfiz-client">
    Full reference for every Client and Application method
  </Card>

  <Card title="Static Verification" icon="shield-check" href="/enforcement/static-verification">
    Run `alfiz-verify` to catch ungated surfaces at build time
  </Card>
</CardGroup>

## Is Alfiz for you?

What qualifies you is the shape of your problem, not the size of your company. It fits if you recognize one of these:

| If this is your situation                                                                | What answers it                                                          |
| ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
| Your `isAdmin` boolean isn't enough anymore.                                             | [Scoped grants and scope types](/access/grants-revokes)                  |
| You need folder-level or per-document permissions and you're about to write it yourself. | [Object closures and the ancestry resolver](/access/scopes-hierarchy)    |
| You have permission strings scattered across 40 files and no idea if they're all gated.  | [`alfiz-verify` coverage linting](/enforcement/static-verification)      |
| You don't want an authorization service on your request path.                            | [In-process checks against your own database](/enforcement/check-shapes) |
| You want a typo in a permission key to be a build error.                                 | [Catalog-derived template-literal types](/api/catalog-types)             |

If a single role column is genuinely enough for your application, it will stay enough, and Alfiz is more machinery than you need.

## Four commitments

<CardGroup cols={2}>
  <Card title="Declared in code" icon="file-code">
    Your permission catalog is TypeScript, declared in the codebase that enforces it. There is no second list in a dashboard to drift out of sync with it.
  </Card>

  <Card title="Checked in your own process" icon="door-open">
    `can()` runs in-process against your own database. Nothing Alfiz operates is on your request path, so nothing it does can slow or stop a check.
  </Card>

  <Card title="Typed end to end" icon="brackets-curly">
    Keys and patterns are template-literal types derived from your catalog. An unknown permission key is a compile error rather than a silent `false`.
  </Card>

  <Card title="Verified in CI" icon="circle-check">
    `alfiz-verify` proves the two directions match: nothing is enforced that isn't declared, and the build warns on anything declared that no gate references.
  </Card>
</CardGroup>

<Note>
  Grants nest rather than fan out: a grant made at an enclosing scope covers everything within it, resolved by walking up ancestors at check time. See [Scopes and hierarchy](/access/scopes-hierarchy).
</Note>

## Get started

<Steps>
  <Step title="Install packages">
    ```bash theme={null}
    npm install @alfiz/core @alfiz/application
    ```
  </Step>

  <Step title="Define your catalog">
    Declare namespaces, permissions, and scope types in a single TypeScript module.
    See the [Catalog overview](/catalog/overview) to learn the shape.
  </Step>

  <Step title="Create the application and client">
    Wire a storage driver and ancestry resolver, then call `createAlfizClient`.
    The [Quickstart](/quickstart) walks through this end-to-end.
  </Step>

  <Step title="Run your first check">
    ```ts theme={null}
    const allowed = await alfiz.can({ userId }, "docs.files.read", "docs.doc:123");
    ```

    Every check is typed against your catalog, so unknown keys are compile errors.
  </Step>
</Steps>

## Packages

| Package              | Purpose                                                                                                                   |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `@alfiz/core`        | Client: grammar, catalog, check shapes, caches, headless tree logic, plus the provider contract and its OpenAPI wire form |
| `@alfiz/application` | Application: the local provider against your database, plus both halves of the Provider API wire                          |
| `@alfiz/prisma`      | Prisma storage driver for the Application                                                                                 |
| `@alfiz/mongo`       | MongoDB storage driver for the Application                                                                                |
| `@alfiz/verify`      | `alfiz-verify` CLI for static call-site verification                                                                      |

The packages above are complete on their own. Groups, roles, reporting hierarchy, access requests, approvals, sessions, and permission metrics all run against your own database with no external dependency. [Alfiz Cloud](/cloud/overview) adds hosted administration and cross-application federation when you want them, and is never required.

<Note>
  Check volume is not a billing dimension and will not become one. Alfiz Cloud bills for the work it performs: admin seats, federated applications, connectors, retained audit volume. See [Metering and caps](/cloud/metering).
</Note>