AuthZ for the
hardest problems.
Policy-as-contract authorization. Multi-tenant. Fine-grained. Audited. CLI-first. Self-hosted or cloud — the security team writes policy in a form that the machine can verify, and the developer integrates once.
The capability set, in writing.
Fine-grained, resource-level control
Match access policies to the exact resources they govern. No coarse roles, no wildcards by default — what is permitted is named.
Multi-tenant by construction
Tenant isolation is a property of the data model, not an opt-in flag. Customers cannot see each other's policies, users, or resources.
CLI-first design
Every operation has a flag. Test, dry-run, diff, and apply policies through housectl — review them in pull requests like any other artifact.
Self-hosted or cloud
Operate Housecarl in our cloud, in yours, or on your bare metal. The same binary, the same wire format, the same policy semantics.
Single sign-on, in production
Google OAuth today. GitHub and Azure AD ready. JWT-backed sessions, attribute mapping, and role inheritance are first-class concerns.
Auditable by default
Every authorization decision is logged with principal, action, resource, and policy reference. Audit log is queryable and exportable.
Built-in billing
Subscription management with usage tracking. Monetize a multi-tenant product without writing a billing service first.
Engineered to last
Rust on the wire and at rest. PostgreSQL for state. gRPC for the data plane. Nothing exotic; everything explicit.
Teams that have outgrown roles & bools.
Complex permission models
Multiple teams with different permission structures. Matrix roles with cross-cutting access. Organizations whose access patterns don't fit a flat list of capabilities.
Compliance-driven engineering
Policies that mirror regulatory or corporate controls — and an audit trail that demonstrates them.
On-premise control
Self-host to maintain compliance with information controls your security team has already deployed.
MLS & high-rigor deployments
Multi-level security. Air-gapped sites. Edge and disrupted environments — on the roadmap, not as an afterthought.
Read the docs. Then ask for an account.
Housecarl AuthZ ships in Q2 2026. Cloud and self-hosted editions exist. Private beta is open for serious operators.