AI
Why Coarse-Grained Gateway Auth Is Not Enough
Fintech teams need access revoked the moment a portfolio is removed, not when a token expires. That gap drove this talk. Gateway checks today cover the basics: is the token valid, does it have the right audience, does it carry the right claims. Fine-grained decisions, such as whether a specific user can access a specific account, get pushed into each application separately. Changes do not propagate instantly, and auditors eventually notice.
OpenFGA: A Graph That Powers Real-Time Permission Checks
OpenFGA stores permissions as a graph. You declare an authorization model: entities such as teams, agents, and users, and their relationships to resources like models or tools. You then write relationship tuples, for example “Alice is a member of the engineering team” or “members of engineering can use model GPT-4.” The gateway queries that graph at request time: can user Alice use model GPT-4? The graph traversal answers it. Updating one tuple instantly changes who gets through, no cache flush or token rotation needed.
Demo: Instant Permission Changes Across Users and Agents
The live demo ran Alice, Dave, Carol, and Bob against a self-hosted mock model behind Envoy AI Gateway. Alice passed because she belongs to the engineering team. Carol was blocked. Dave passed via a direct grant that bypassed team membership entirely. Bob, a new contractor, gained access the moment he was added to the engineering team in the OpenFGA graph. An agent attached to the engineering team started with read-only GitHub access and received write access after one graph update. Round-trip time shown in the UI: 4 milliseconds.
Envoy Dynamic Modules: Bringing OpenFGA Into the Gateway
Envoy dynamic modules let developers add new filters without forking the proxy. Hughberg built an OpenFGA filter using Composer, an open-source extension available at builtonenvoy.io. The filter loads as a plugin, connects to the OpenFGA deployment, and fails closed: if it cannot reach OpenFGA, requests are rejected. A PR is open in the public repo and can be reviewed now. The filter works with Envoy AI Gateway, Envoy Gateway, or standalone Envoy proxy.
Token Quotas and Audit Logs as Authorization Rules
OpenFGA can store token quotas alongside team membership. A rate-limit service running earlier in the Envoy filter chain reports how many tokens a user has consumed. The OpenFGA check then compares that figure against the quota stored in the graph. Upgrading a user from a basic to a premium tier takes one graph write, and the next request immediately reflects the new limit. Envoy’s access logs capture every request, and OpenFGA logs every check, giving auditors a full trail of who accessed what resource and when.
Notable Quotes
we are updating the open FGA graph in real time here. This is this edits the graph when I remove it and add it. It edits the graph that is powering the authorization Erica Hughberg · ▶ 12:01
and those four milliseconds there is the time it takes to go through the gateway open everything that’s going on. Andres Aguiar · ▶ 12:11
important we are failing closed. So if we can’t connect to Open FJ, it’s actually going to reject the requests. Erica Hughberg · ▶ 19:01
It’s not just about identity or team membership. It it goes beyond that. Andres Aguiar · ▶ 20:59
Key Takeaways
- OpenFGA graph updates propagate instantly, removing the token-expiry wait for access revocation.
- Envoy dynamic modules let a single OpenFGA filter handle fine-grained checks at the gateway layer in 4 milliseconds.
- Failing closed: if OpenFGA is unreachable, Envoy rejects the request rather than defaulting to allow.
About the Speaker(s)
Erica Hughberg is a maintainer of Envoy AI Gateway at Tetrate and a community advocate focused on building secure, user-focused application platforms. She hosts the Envoy AI Gateway community meeting every Monday.
Andres Aguiar is Director of Product at Okta and a maintainer of OpenFGA, the open-source fine-grained authorization system built on a graph model at openfga.dev.