pg_permissions documentation
Use pg_permissions as your application’s authorization store and check engine in Postgres. Manage roles, relationships and policies with the JavaScript client or SQL, then check access from your backend. Row level security (RLS) is an optional integration for enforcing access on tables. The extension is pure SQL and runs on Postgres 16, 17, and 18.
New to the project? Read the overview, install the extension, and run your first permission check. The quickstart assigns a role and compares two users’ access before showing an optional RLS example.
Choose a model
Section titled “Choose a model”RBAC grants permissions through roles, either app-wide or within a tenant. OpenFGA grants access through relationships to individual objects. Cedar grants or denies access with policies on attributes, groups and the request. All three live in the permissions schema and work without RLS.
Use the model chooser to find the right starting point. Adding object sharing to an RBAC application does not require migrating its role assignments.
Build your application
Section titled “Build your application”| Task | Read |
|---|---|
| Use the extension as your backend’s authorization store and check engine | Check access in your application |
| Identify the user making a request | Identity and request context |
| Connect from Node or a browser | JavaScript setup |
| Give a backend access to admin functions | Client and admin privileges |
| Assign roles across the application | App-wide roles |
| Give users different roles in each organization | Tenant-scoped roles |
| Share an individual document | Share objects and manage tuples |
| Grant access that expires | Conditions and request context |
| Write policies with conditions and denies | Write policies |
| Link one policy shape to many users | Use policy templates |
| Protect a table with a Cedar policy | Policies for Cedar |
| Combine checks from different models in your backend | Combine model decisions |
| Optionally enforce roles and shares on one table | Combine models with RLS |
| Remove permissions when a user is deleted | Delete users and clean up permissions |
Reference and research
Section titled “Reference and research”Start with JavaScript methods, or look up shared functions, RBAC functions, OpenFGA functions, or Cedar functions. Errors, limits, and CEL support have their own reference pages.
Benchmarks has the current latency numbers for each model at 10 thousand, 100 thousand and 1 million documents.
Research and design explains the architecture and preserves the earlier prototypes, measurements, and decisions. Those prototypes are historical implementations, not installation choices.
Example conventions
Section titled “Example conventions”Choose JavaScript or SQL when a guide offers both. The site remembers your selection. JavaScript examples use the permissions client. SQL examples use named arguments and lowercase keywords. Each task page states its prerequisites; run its steps in order unless a block is marked as a fragment or an expected error.
The examples call the extension owner the admin. Functions that change roles, models, tuples, Cedar policies or entities run as that role or an explicitly authorized backend. Policy tests switch to the application’s database role so that RLS applies.
Some examples use psql variables, such as :'alice'. The OpenFGA user field is named subject in SQL because user is reserved. JavaScript uses user and camel-case argument names.