Skip to content
Qeet ID
Read the docs
In development

Who can do what. And why, every time.

Roles, attributes and relationships, decided on the server for every caller — with the reason behind each answer, and a deny that always wins.

Read the docsTalk to us

  1. Ask

    A person, an API key or an agent asks to do something.

  2. Roles

    The roles they hold, directly or through their groups.

  3. Relationships

    What they are to the thing they are asking about.

  4. Conditions

    Attributes, second factor and address — a missing attribute counts as unknown.

  5. Decide

    Allow or deny, with the path that granted it. A deny always wins.

01Models

Roles, attributes, relationships. One decision.

The model everyone knows, done carefully.

Built-in admin, member and viewer roles, and custom roles with exactly the permissions you set. Roles come from a person's groups, and every role says who holds it — directly or through a group.

Roles in the docs
  • Built-in admin, member and viewer roles
  • Custom roles, set in one call, renamed or deleted
  • Each permission says which role or group grants it

PlansOn every plan

02Explained

Every answer comes with its reason.

What you can see

  1. The grant path

    Ask with explain, and the answer traces the role or relationship that granted it.

  2. The reason

    Every authorization result carries a code that says why.

  3. The decisions

    The access decisions an organisation asks for are kept 30 days, and listed.

What it rules out

  • Deny wins

    A refusing policy always wins over any allow.

  • Fail closed

    A route without a policy is refused, and so is an error.

  • No self-promotion

    Adding someone to a group checks the group's roles first.

  • Fewer privileges only

    Admins act only on people with fewer privileges; only owners act on owners.

03Every caller

Machines are checked as closely as people.

  • By exact scope

    A machine caller is authorised by its exact scope, on every route.

  • No wider than its maker

    A key or an agent carries only scopes its creator holds.

  • Apps see their own people

    An app can be limited to the people and groups assigned to it.

  • Hooks can say no

    A sign-in hook can refuse a sign-in, and can be test-called before it goes live.

04On each plan

Roles on every plan. Policies from Pro.

  • Free

    ₹0/month

    10,000 users

  • Starter

    ₹2,400/month

    25,000 users

  • Pro

    ₹8,000/month

    100,000 users

  • Enterprise

    Custom

    Custom scale

  • Roles and permissions: Free: 3 roles; Starter: Unlimited; Pro: Unlimited; Enterprise: Unlimited

  • Groups: not on Free; Starter: included; Pro: included; Enterprise: included

  • Attribute and relationship policies: not on Free; not on Starter; Pro: included; Enterprise: included

  • Address rules: not on Free; not on Starter; Pro: included; Enterprise: included

  • Sign-in hooks: not on Free; not on Starter; Pro: included; Enterprise: included

Full pricing and calculator

Write your first policy.

Read the docsTalk to us