Fine-Grained Auth
Capability Checks
Root-level permission checks for global gates.
HasCapabilityAsync checks whether a subject has a specific permission on the configured FGA root resource. Use it only for capabilities you deliberately grant at root. It does not search every descendant for any matching grant.
var canCreateChains = await authService.HasCapabilityAsync(subjectId, "CHAIN_EDIT");
if (!canCreateChains)
return Results.Json(new { error = "Permission denied" }, statusCode: 403);| Scenario | Method |
|---|---|
| "Can this user edit this chain?" | CheckAccessAsync with a resource ID |
| "Does this user have our global create-chain capability?" | HasCapabilityAsync, with a role granted on root |
| "Can this user edit at least one chain somewhere?" | Query/filter the relevant chain resources; HasCapabilityAsync does not answer this |
| "Show me all chains this user can see" | GetAuthorizationFilterAsync |
HasCapabilityAsync is useful for: