1 Best APIs for Relationship-Based Access Control in Nigeria

Warrant is an authorization-as-a-service platform that provides APIs for implementing fine-grained, scalable access control in applications — replacing the complex custom permissions systems that most engineering teams build from scratch. Authorization — determining whether a specific user is allowed to perform a specific action on a specific resource — is a fundamental requirement of virtually every application, but implementing it correctly is notoriously difficult. Warrant externalizes this complexity into a dedicated service, providing simple APIs for defining roles, permissions, and object-level access rules, and a fast check API for enforcing those rules at request time. Nigerian B2B SaaS companies and enterprise software teams face authorization complexity as a daily challenge. A Nigerian project management platform needs to ensure that Company A users never see Company B projects, that project managers can assign tasks but viewers cannot, and that document owners can share access with specific individuals. Implementing this with custom database queries and application logic is error-prone, hard to audit, and increasingly complex as the permission model grows. Warrant solves this with a model-driven approach: define the access structure once, and the check API handles enforcement. Warrant supports two complementary access control models. Role-Based Access Control (RBAC) assigns users to roles (admin, editor, viewer) and permissions to roles — a user gets all permissions of their assigned roles. This model works well for simple, hierarchical permission structures. Relationship-Based Access Control (ReBAC), inspired by Google Zanzibar, defines access based on direct relationships between users and objects — "User X is the owner of Document Y," "Group G has edit access to Project P," "User X is a member of Group G." ReBAC enables the rich, object-level sharing models used by Google Docs, Dropbox, and modern collaboration tools. The core Warrant Check API (/v2/check) accepts a subject (who), relation (what action), and object (what resource) and returns an allow or deny decision in milliseconds. Nigerian applications call this API at every access-sensitive operation — before rendering a page, before executing a database query, before returning API data. The check API handles all the relationship traversal and permission inheritance logic, returning a simple boolean decision. The Warrant Warrant Query Language (WQL) enables complex authorization queries: "What objects does User X have edit access to?" or "Who has access to this document?" These queries power features like permission-filtered list views where users only see resources they are authorized to access — a common requirement in Nigerian multi-tenant SaaS applications. Warrant is self-hostable via Docker for Nigerian teams that need data residency control or want to avoid third-party dependencies for their authorization system. The hosted service provides 1 million authorization checks per month on the free tier — sufficient for many Nigerian applications in early stages. SDKs are available for Node.js, Python, Go, Ruby, and Java. Warrant's Warrant Definition Language provides a way to express complex authorization policies as structured rules rather than imperative code — defining what resource types exist, what relationships between users and resources are possible, and what permissions each relationship grants. This declarative approach makes authorization policies auditable, reviewable, and modifiable without touching application code, which is important for Nigerian companies where authorization requirements change with regulatory or business conditions. The Warrant dashboard provides visual exploration of the permission graph — showing which users have access to which resources and through what chains of roles and relationships. This visibility is valuable for Nigerian security audits, compliance reviews, and debugging access control issues without needing to write custom queries against the permission data.