Work we have shipped

scoped-authz

A zero-dependency TypeScript library for role-and-scope authorization — the case where some administrators govern everything and others govern a single department, region or tenant. Scope is kept in your own store rather than in the access token, so removing someone’s authority takes effect on a delay you choose instead of whenever their token happens to expire.