OpenFGA

Component Category

Access and security / authorization

Component Description

OpenFGA is a fine-grained authorization system designed to model and evaluate access relationships at scale.

Why It Is Used

In BullSequana AI Runtime, OpenFGA supports granular permission models beyond simple role checks. It helps enforce consistent authorization across services, resources, and platform operations.

Learn More

• OpenFGA documentation
• openfga/openfga on GitHub

Deployment notes

OpenFGA deploys into the openfga namespace at sync wave 1 in the coreai tier. It uses the CNPG PostgreSQL cluster for persistence. A DatabaseRole CRD and a Database CRD provision the role and database at negative sync waves, and a permissions Job grants the required privileges before the application starts. The OpenFGA schema migration runs as a Helm post-install hook.

Interacts With

• PostgreSQL, which stores the OpenFGA authorization data model and state.
• Keycloak, as part of the broader identity and authorization flow across the platform.
• Temporal, where authorization-related workflow coordination and synchronization can be connected at the platform level.