Best Practices of Managing Tuples and Invoking APIs
note
Auth0 Fine Grained Authorization (FGA) is the early-stage product we are building at Auth0 to solve fine-grained authorization at scale.
Sign up for the Developer Community Preview to try it out, and join our Discord community if you are interested in learning more about our plans.
Please note that at this point in time, it is not considered production-ready and does not come with any SLAs; availability and uptime are not guaranteed. Limitations of Auth0 FGA during the Developer Community Preview can be found here.
Please note that at this point in time, it is not considered production-ready and does not come with any SLAs; availability and uptime are not guaranteed. Limitations of Auth0 FGA during the Developer Community Preview can be found here.
The following list outlines some guidelines and best practices for using Auth0 FGA:
- Do not store Personal Identifiable Information in tuples
- Always specify authorization model ID whenever possible
Do Not Store Personal Identifiable Information in Tuples
You can use any string for user and object identifiers, however you should not input or assign identifiers that include Personal Data or any other sensitive data, such as data that may be restricted under regulatory requirements.
Note
The documentation and samples uses first names and simple ids to illustrate easy-to-follow examples.
Always Specify Authorization Model ID Whenever Possible
It is strongly recommended that authorization model ID be specified in your Relationship Queries (such as Check and ListObjects) and Relationship Commands (such as Write).
Specifying authorization model ID in API calls have the following advantages:
- Better performance as Auth0 FGA will not need to perform a database query to get the latest authorization model ID.
- Allows consistent behavior in your production system until until you are ready to switch to the new model.