Authorization and Permissions

Nishi vs the field — every Nishi cell is measured against real organ source at emit time; each gap names the watch contract that will close it.

One sovereign ReBAC plane -- relationship tuples with userset rewrites over an append-only store, bound to OPAQUE-PAKE identity and Nishi HR -- vs SpiceDB and OpenFGA and AWS Cedar and Ory Keto

Layer 1 · Executive

Where we are. The sovereign ReBAC plane is real and adversarially gate-proven across 28 checks: relationship tuples on an append-only store, data-driven userset rewrites, nested-group expansion, deny-by-default with additive tombstones, block-outranks-consent, HR-level override, no-self-escalation write authority, per-relation reverse lookup, and two structural exceeds (authorization bound to OPAQUE-PAKE identity; the whole plane terminates its own TLS). It is honestly BEHIND the mature incumbents on snapshot-consistency tokens, an admin-authored schema language, a precomputed reverse index and horizontal scale -- the four open rungs below.

Where we need to go. A Zanzibar-class plane a tenant admin can MODEL without a recompile, whose checks are snapshot-consistent under caching (no new-enemy window), whose list-objects answers from a maintained reverse index, and which shards across hosts without losing the exceeds -- every grant still an immutable record, every decision still bound to a password that never crossed the wire.

The unit. 1 u = one measured session-leg, the estate's shared calibration (graphics R21 parts-to-live in one leg on 2026-08-15; mangagen R2 and R3 corroborate). No authz rung has landed under this unit yet -- recalibrate on the first one and publish actual against estimate.

Where we are: 4 open rungs. Core plane present and exceeding on two axes; the four named gaps are the incumbents' maturity axes, not hand-waved wins. Coverage and counts are measured at emit below this line.

Cost to snapshot consistency: 1 u. AZ1 mints a consistency token per write and lets a check pin its read to it, closing the new-enemy window the moment any cache appears.

Cost to an admin-authored model: 3 u. AZ2 the schema language compiling to the existing rewrite table, then AZ3 the precomputed reverse index it enables.

Cost to horizontal scale: 6 u. AZ4 sharded routing over the seg_store walk, correct only once AZ1 tokens exist -- declared in that order so the cache cannot ship before its consistency primitive.

Research bar. SpiceDB (AuthZed) is measured on Zanzibar-faithful engine: schema language, zedtoken consistency, LookupResources, distributed cache. Theirs: zedtokens plus a schema DSL plus reverse index. Ours: AZ1 through AZ4 measured on this page.

Research bar. OpenFGA (CNCF) is measured on modeling DSL, consistency modes, ListObjects at scale. Theirs: DSL plus ListObjects. Ours: AZ2 and AZ3 are the parity rungs.

14 of 18 capabilities measured|2 of them measured exceeds|4 open|coverage 777/1000|adoption 14 full / 0 partial

Layer 2 · Roadmap

Do this next — computed by the ranker, never chosen by a seat

Order from nx_compare_rank (nx_dr_ocm: (deficit + cost-of-delay + option + enables) x sponsor x self-sufficiency x momentum / cost). FINISH rows are rungs whose symbol is present but whose organ is short of full adoption: the cheapest closures on this board, listed before any new work. Stamp: # asof=1787883307 domain=authz target_version=0.1 rungs=5 done=1 open=4 finish=0 ranker=nx_dr_ocm

#	Stage	Rung	Priority	Derivation
#1	0.1	Consistency tokens (AZ1) rbc_zedtoken_mint	2600	v=13 m=2 c=10
#2	later	Admin schema language (AZ2) rbs_schema_compile	1800	v=18 m=2 c=20
#3	later	Precomputed reverse index (AZ3) rb_reverse_index	700	v=7 m=1 c=10
#4	later	Sharded routing (AZ4) rbx_shard_route	300	v=9 m=1 c=30

Critical path — contract, done-rule, executor, cost

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
ReBAC core check (AZ0)	rb_check	Bounded check with cycle termination over the tuple store; landed and gate-proven -- listed so dependents carry its momentum	Organ	0 u
Consistency tokens (AZ1) after AZ0	rbc_zedtoken_mint	Every write mints a monotonic token bound to the store generation; a check given a token refuses to answer from any state older than it; gate proves a stale-cache read is REFUSED not served (the new-enemy control) and an at-least-as-fresh read is served	Organ	1 u
Admin schema language (AZ2) after AZ0	rbs_schema_compile	A tenant admin authors object types, relations and computed usersets as text; the compiler emits the SAME rewrite table rb_expand reads today (byte-identical for the current model as the neutrality proof); an unparseable schema is refused whole, never half-loaded	Organ	2 u
Precomputed reverse index (AZ3) after AZ2	rb_reverse_index	A maintained subject-to-objects index updated on every grant and tombstone; list-objects answers from the index and a gate proves index answers equal the per-relation walk over the whole fixture graph, including nested groups	Organ	1 u
Sharded routing (AZ4) after AZ1,AZ3	rbx_shard_route	Tuples partitioned by object hash across hosts with AZ1 tokens carried through every hop; the gate proves a cross-shard check with a pinned token never reads a stale replica and the audit trail stays additive per shard	Organ	3 u

Milestones

Milestone	Rungs	Cumulative
M1 · Snapshot-consistent checks	AZ1	1 u
M2 · Admin-authored model with reverse index	AZ2,AZ3	4 u
M3 · Distributed plane	AZ4	7 u

Layer 3 · Engineering

How this is scored. Every Nishi mark is measured: the generator reads the real organ source on disk and requires the implementing symbol to exist (no self-grading). A watching tag names the organ and symbol contracted to close a gap — the mark flips itself on the next compare beat when that workstream ships, and the comparewatch- plane row flips with it. The flip is necessary, not sufficient: it proves the symbol exists, never that the capability is good. The bar is the rung's pre-declared done-rule, proven by its gate — a symbol shipped without the behaviour behind it is a defect, and the flip is exactly what makes that defect visible instead of quiet. Competitor marks record documented capability presence — presence, not depth or scale. Adoption is measured too: every measured row carries where its organ stands on the estate's ladder (source → built → promoted → registered → invoked; libraries by importer reach minus validation importers; gates by the execution surfaces that run them). A row is fully adopted only at the top of its ladder; anything short is tagged partial with the exact remedy, so a build nobody promoted can no longer read as shipped. Census stamps: importers asof 1787849099, gate census asof 1787855507 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ leads / measured exceed● present◐ partial○ absent · click any capability for its evidence

Capability	Nishi	SpiceDB	OpenFGA	AWS Cedar	Ory Keto
Relationship tuples object relation subject Measured: `rb_save_tuple` exists in `runtime/nx_rebac.nx`, verified at emit. SpiceDB and OpenFGA and Keto are Zanzibar tuple stores [keto] [zanzibar2019] and Cedar models relationships via policy rather than native tuples [cedar-docs]; Nishi persists every tuple as an append-only seg_store record Adoption: `LIB-WIRED importers=6 nonval=4` — fully adopted (top of its ladder).	●	◉	●	◐	●
Userset rewrites and computed relations Measured: `rb_expand` exists in `runtime/nx_rebac.nx`, verified at emit. SpiceDB schema and OpenFGA models define computed usersets and Cedar uses policy conditions; the Nishi rb_expand rewrite table is data-driven config not buried logic Adoption: `LIB-WIRED importers=6 nonval=4` — fully adopted (top of its ladder).	●	◉	●	◐	●
Bounded check with cycle termination Measured: `rb_check` exists in `runtime/nx_rebac.nx`, verified at emit. Every engine bounds evaluation; the Nishi check terminates a member-of cycle by construction via RB_MAXDEPTH which the adversarial gate proves does not hang Adoption: `LIB-WIRED importers=6 nonval=4` — fully adopted (top of its ladder).	●	◉	●	●	●
Deny-by-default with tombstone revocation Measured: `rb_tuple_current` exists in `runtime/nx_rebac.nx`, verified at emit. All deny by default; Nishi revokes with an ADDITIVE tombstone that never deletes history and resolves latest-wins so the audit trail stays intact Adoption: `LIB-WIRED importers=6 nonval=4` — fully adopted (top of its ladder).	●	●	●	●	●
Write authority with no self escalation Measured: `rb_may_grant` exists in `runtime/nx_rebac.nx`, verified at emit. Only an owner or admin may grant and an unclaimed object bootstraps exactly once then closes so a member can never self-grant admin Adoption: `LIB-WIRED importers=6 nonval=4` — fully adopted (top of its ladder).	●	●	●	●	●
Nested group and subgroup usersets Measured: `rb_split_userset` exists in `runtime/nx_rebac.nx`, verified at emit. Sharing with a group expands member usersets including nested subgroups which the gate proves end to end with a leads-inside-elders chain Adoption: `LIB-WIRED importers=6 nonval=4` — fully adopted (top of its ladder).	●	◉	●	◐	●
Multi tenant wall enforced in the live app Measured: `rv_acl_load` exists in `runtime/nx_relate_serve.nx`, verified at emit. The wall-beats-admin tenant model runs LIVE on nishifamily dot com slash relate not merely as a library selftest Adoption: `LIB-WIRED importers=4 nonval=2` — fully adopted (top of its ladder).	●	●	●	●	●
Field level attribute masking Measured: `rv_amt_ok` exists in `runtime/nx_relate_serve.nx`, verified at emit. Giving amounts mask below manager role; SpiceDB caveats and Cedar conditions and OpenFGA contextual tuples also gate at the attribute grain Adoption: `LIB-WIRED importers=4 nonval=2` — fully adopted (top of its ladder).	●	●	●	●	●
Capability path prefix ACL secondary engine Measured: `acl_eval` exists in `runtime/_hdl_build/nx_vault_acl.nx`, verified at emit. Longest-prefix capability grants with explicit-deny-wins complement the relationship graph for per-record vault scoping Adoption: `LIB-WIRED importers=5 nonval=2` — fully adopted (top of its ladder).	●	●	●	●	●
Additive-only audit trail of every grant Measured: `ss_commit` exists in `runtime/nx_seg_store.nx`, verified at emit. Every grant and revoke is an immutable seg_store record so the authorization history is tamper-evident by construction rather than a separate audit log Adoption: `LIB-WIRED importers=441 nonval=321` — fully adopted (top of its ladder).	●	●	●	●	●
Unified identity roles and relationships in one plane Measured: `rb_check_hr` exists in `runtime/nx_rebac.nx`, verified at emit. The incumbents are authorization engines that consume an external identity provider; Nishi composes the HR level and the relationship graph keyed by the same uid hash equal to sha256 of realm and handle Adoption: `LIB-WIRED importers=6 nonval=4` — fully adopted (top of its ladder).	●	◐	◐	◐	◐
EXCEED authorization bound to OPAQUE-PAKE identity Measured exceed: `OPAQUE` in `runtime/nx_opaque_login.nx`, verified at emit. Incumbents authenticate the caller with bearer tokens or OIDC then authorize; the Nishi plane binds authorization to an OPAQUE-3DH session where the password never crosses the wire and the server stores no password-equivalent [rfc9807] Adoption: `RUN-BY:daemon` — fully adopted (top of its ladder).	◉	○	○	○	○
EXCEED sovereign end to end with own TLS no vendor Measured exceed: `WITHOUT terminating` in `runtime/nx_sni_route.nx`, verified at emit. SpiceDB and OpenFGA and Keto and Cedar are services or libraries you run behind someone elses TLS and cloud; the Nishi plane terminates its own TLS 1.3 [rfc8446] and runs on owned hardware from ClientHello to decision Adoption: `LIB-WIRED importers=3 nonval=1` — fully adopted (top of its ladder).	◉	○	○	○	○
Consistency tokens for snapshot reads Open — watching `runtime/nx_rebac_consistency.nx` : `rbc_zedtoken_mint`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. SpiceDB zedtokens [spicedb-consistency] and OpenFGA consistency modes solve the new-enemy problem across caches; the Nishi check reads the current store with no snapshot token yet watching rbc_zedtoken_mint	○	◉	◉	●	◉
Admin authored schema or policy language Open — watching `runtime/nx_rebac_schema.nx` : `rbs_schema_compile`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. SpiceDB schema [spicedb-schema] and OpenFGA DSL and Cedar policy [cedar2024] let an admin DEFINE the model; the Nishi rewrite table is compiled data not a user-authored schema yet watching rbs_schema_compile	○	◉	◉	◉	◉
Reverse index and list objects Measured: `rb_list_objects_for_sub` exists in `runtime/nx_rebac.nx`, verified at emit. SpiceDB LookupResources and OpenFGA ListObjects are the reference [openfga]; Nishi now enumerates via rb_list_objects_for_sub and the office shared-with-me view expands group usersets on the reverse side -- per-relation lookup is live, a fully precomputed reverse index across the whole graph is the remaining depth Adoption: `LIB-WIRED importers=6 nonval=4` — fully adopted (top of its ladder).	●	◉	●	●	●
Horizontal scale and distributed cache Open — watching `runtime/nx_rebac_scale.nx` : `rbx_shard_route`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. SpiceDB and the original Zanzibar scale to billions of tuples behind a distributed consistent cache [zanzibar2019]; the Nishi plane is a single-host seg_store walk today watching rbx_shard_route	○	◉	●	●	◉
Precomputed whole-graph reverse index Open — watching `runtime/nx_rebac.nx` : `rb_reverse_index`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. SpiceDB LookupResources and OpenFGA ListObjects answer from a maintained reverse index [openfga]; rb_list_objects_for_sub walks per relation at query time -- the precomputed index across the whole graph is the remaining depth, named here as the contract so the cell flips when it ships watching rb_reverse_index	○	◉	●	●	●

Risk register

Risk	Likelihood x impact	Mitigation
A schema language that compiles to a different table than the hand-written one silently changes every decision	possible x high	AZ2 done-rule is byte-identity against the current rewrite table before any new model is admitted.
A cache shipped before consistency tokens reintroduces the new-enemy problem the plane is currently immune to by having no cache	possible x high	AZ4 depends on AZ1 by declaration; the ranker will not put it on the critical path first.

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

Honest verdict. The Nishi plane is a real Zanzibar/ReBAC engine -- relationship tuples, data-driven userset rewrites, nested-group expansion, deny-by-default with additive tombstone revocation, block-outranks consent, HR-level operator override, and no-self-escalation write authority -- all adversarially gate-proven across 28 checks. Two structural exceeds are unique to it: authorization is bound to an OPAQUE-PAKE session (the password never crosses the wire) and the whole plane terminates its own TLS on owned hardware with zero vendor dependency. It is honestly BEHIND the mature incumbents on four axes -- consistency tokens for snapshot reads, an admin-authored schema language, a reverse index for list-objects, and horizontal distributed scale -- which are the named next rungs, not hand-waved wins.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/authz.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain authz, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[zanzibar2019] Pang, Caceres, Burrows, Chen, Dave, Germer, Golynski, Graney, Kang, Lloyd, Sanders, Sudhindra, Tsang, Zhang. Zanzibar: Google's Consistent, Global Authorization System. USENIX ATC 2019. publisher · read in our library knowledge/fetched/cmp_authz_zanzibar2019.html · pin ha2dda3fa628e5a7643e5cef0ebf9743ff27373f87826a4b82925a78c5ba093eb · accessed 2026-08-18 · published-paperGrounds: The model behind the whole plane: Relationship tuples object relation subject, Userset rewrites and computed relations, Nested group and subgroup usersets, and Bounded check are Zanzibar's tuple, userset-rewrite and check semantics; the Consistency tokens for snapshot reads row (zookies and the new-enemy problem) and Horizontal scale and distributed cache row (billions of tuples behind a distributed consistent cache) are the two named gaps this paper defines.
[spicedb-schema] AuthZed. SpiceDB documentation: Schema Language Reference -- object definitions, relations, computed permissions, caveats. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_authz_spicedb-schema.html · pin hf463819877d351b0b15418f61b61efc8d35108bc28445bed38cfa993c85358ce · accessed 2026-08-18 · vendor-docGrounds: The SpiceDB column: Best on Relationship tuples, Userset rewrites and Nested group usersets (a Zanzibar tuple store with computed usersets), caveats on Field level attribute masking, and Best on Admin authored schema or policy language -- an admin DEFINES the model in this schema, where the Nishi rewrite table is compiled data.
[spicedb-consistency] AuthZed. SpiceDB documentation: Consistency -- ZedTokens (Zanzibar zookies), consistency modes and the New Enemy Problem. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_authz_spicedb-consistency.html · pin h3017532d9db2126df3f072cebdf9dbbbd702480a37083600570953955b2cf8b1 · accessed 2026-08-18 · vendor-docGrounds: The Consistency tokens for snapshot reads row: SpiceDB zedtokens solve the new-enemy problem across caches (SpiceDB Best), while the Nishi check reads the current store with no snapshot token yet -- the first named next rung.
[openfga] OpenFGA (CNCF). What is FGA? Fine-Grained Authorization Explained -- the OpenFGA documentation entry: Zanzibar-inspired relationship-based authorization with an authorization-model DSL. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_authz_openfga.html · pin hfdcd1c23747f86fabf855a848850c3629f2ad201c7533879db1a36b3951d275a · accessed 2026-08-18 · vendor-docGrounds: The OpenFGA column: an open-source Zanzibar tuple store (Relationship tuples, Userset rewrites, Nested group usersets all Yes), the modeling DSL on Admin authored schema or policy language, and the ListObjects and consistency-mode references named on the Reverse index and Consistency tokens rows.
[cedar-docs] Amazon Web Services. Cedar Policy Language Reference Guide: What is Cedar? -- policies, entities, conditions and schema. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_authz_cedar-docs.html · pin hd1137124779d3d643d65b9a64f17bd8006d7f9eab214eaf06cb892364669151a · accessed 2026-08-18 · vendor-docGrounds: The AWS Cedar column: Cedar models relationships via policy conditions rather than native tuples (Relationship tuples Part, Userset rewrites Part, Nested group usersets Part), gates at the attribute grain through conditions (Field level attribute masking), and lets an admin author the model (Admin authored schema or policy language Best).
[cedar2024] Cutler, Disselkoen, Eline, He, Headley, Hicks, Hietala, Ioannidis, Kastner, Mamat, McAdams, McCutchen, Rungta, Torlak, Wells. Cedar: A New Language for Expressive, Fast, Safe, and Analyzable Authorization (Extended Version). arXiv:2403.04651, 2024. publisher · read in our library knowledge/fetched/cmp_authz_cedar2024.html · pin h84b04da381bd1593c90726cd9b5b16aeb78300bfc0d49c517248bd019a54f981 · accessed 2026-08-18 · published-paperGrounds: The Cedar column codes on the same rows: this paper states the design that makes Cedar policy-first rather than tuple-first (expressive, fast, safe, analyzable, formally modeled), i.e. why Cedar reads Part on the tuple rows and Best on the policy-language row.
[keto] Ory. Introduction to Ory Keto: the first open-source implementation of the Zanzibar design principles -- relation tuples and the Ory Permission Language. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_authz_keto.html · pin hebfca6a446580551ff548c3c772913f1dffd03035a054d3ca9e13474f7f29bb1 · accessed 2026-08-18 · vendor-docGrounds: The Ory Keto column: a Zanzibar-derived relation-tuple engine (Relationship tuples, Userset rewrites, Nested group usersets, Deny-by-default all Yes) with its own permission language on the Admin authored schema row -- one of the four incumbents the plane is graded against.
[rfc9807] Bourdrez, Krawczyk, Lewi, Wood. The OPAQUE Augmented Password-Authenticated Key Exchange (aPAKE) Protocol. IRTF CFRG RFC 9807, 2025. publisher · read in our library knowledge/fetched/cmp_authz_rfc9807.html · pin h0e1ee56460c024fff7057d3743eb73aa4382a4fc274eb484597d6d43b41274cb · accessed 2026-08-18 · published-standardGrounds: The EXCEED authorization bound to OPAQUE-PAKE identity row: OPAQUE with the 3DH instantiation is the protocol nx_opaque_login runs -- the password never crosses the wire, the server stores no password-equivalent, pre-computation attacks on server compromise are resisted -- so authorization here is bound to an aPAKE session, not a bearer token.
[rfc8446] Rescorla, E. The Transport Layer Security (TLS) Protocol Version 1.3. IETF RFC 8446, August 2018. publisher · read in our library knowledge/fetched/cmp_authz_rfc8446.html · pin h370ed8c0e6da22c8b8f4ad0230b6c12e6ec8ae807eca034220070828f25684fb · accessed 2026-08-18 · published-standardGrounds: The EXCEED sovereign end to end with own TLS no vendor row: the plane terminates its own TLS 1.3 (nx_sni_route) on owned hardware from ClientHello to decision, where the incumbents run behind someone else's TLS and cloud.

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/authz.matrix · every Nishi cell verified against organ source at emit time · watch cells re-measured on every compare beat · zero JS, zero trackers