Policy-as-contract
Policies are versioned, auditable artifacts. Match by string, prefix, regex, or glob. Compose rules into domains that inherit through a lattice.
Housecarl AuthZ · Authorization for platform teams
Policies you can defend.
Unbundled authorization for platform teams: one policy engine behind every service you run, on infrastructure you control. Policies match by string, prefix, regex, or glob. Domains compose into a lattice with diamond inheritance. Multi-tenant isolation is a property of the data model, not a flag.
Written down. Signed. Retraceable.
The capability set
Multi-tenant by construction
Tenant isolation is structural, not a flag. Each tenant gets its own policy namespace, keyed through the schema itself, so isolation holds without per-request discipline.
Full audit trail
Every authorization decision is logged with principal, action, resource, and outcome. Retrace any decision after the fact.
gRPC, REST, and CLI
Integrate from any language. gRPC for hot paths, REST for admin tooling, the housectl CLI for operators. Deployed on your own Kubernetes or Linux hosts.
Run it yourself. That's the product.
AuthZ is sold for on-prem deployment: your Kubernetes cluster, your database, your audit log. The hosted demo environment exists so you can evaluate the system before you license it. No vendor lock-in on the authorization plane — the decision point lives on infrastructure you control.
Domain inheritance composes policies into a lattice. Diamond inheritance resolves naturally. Prefix and glob matching make resource hierarchies first-class without enumerating every leaf.
Specification
Availability
On-prem license · hosted demo
Deploys on
Kubernetes · Linux
Interfaces
gRPC · REST · CLI
Audit
Every decision logged
License
Commercial
Read the docs. Drive the demo. Then talk to us.
Housecarl AuthZ is sold directly for on-prem use. Write to sales@housecarl.cloud or straight to paul@upside-down-research.com.