ForAccess

Foraccess is an open framework and specification for fine-grained access control across distributed systems. It defines a policy language and a runtime that enables organizations to express and enforce who can access which resource under which conditions, regardless of service boundaries. The aim is to provide consistent authorization decisions across microservices, data stores, messaging systems, and external APIs.

Foraccess originated from the ForAccess Alliance, established in 2017 to address fragmentation in access control within cloud-native architectures. The first official specification, version 1.0, appeared in 2018, with revisions adding support for attributes, obligations, and auditing. The standard emphasizes interoperability and pluggable decision points.

Core components include the ForAccess Policy Language (FAPL), the Policy Decision Point (PDP) that evaluates requests, the Policy Enforcement Point (PEP) that enforces decisions, and a policy store for storing rules. Attributes such as user identity, role, device, and contextual data are used to determine authorization. Obligations may require actions on grant, such as logging or resource tagging. The framework is designed to integrate with existing standards such as OAuth 2.0, Open Policy Agent (OPA), and XACML-like profiles.

Use cases include API gateways enforcing access to microservices, service meshes controlling inter-service calls, and data-access layers in data lakes. Benefits include centralized policy management, improved auditability, and reduced hard-coded access logic. Critics point to the added complexity of maintaining policies across diverse systems and potential performance overhead.

See also: ABAC, PBAC, XACML, OAuth, and Open Policy Agent.