Enterprise Authorization

The Entitlement Story

Bridging the gap between standardized policy models and practical, real-world needs for secure, scalable applications.

Entitlement Services Visualization

The Vision

Reliable, Scalable, and Practical

Building secure and scalable applications is rarely simple. Through years of working on entitlement projects for leading financial firms, I learned a hard truth: no single product can perfectly address every scenario without customization.

While popular frameworks have strengths, they often fall short in real-world projects involving complex workflows and strict compliance:

  • XACML: Unmatched flexibility and powerful obligations, but often difficult to align with developer requirements.
  • FGA: Simplifies object-level permissions, but data migration is painful and lacks the critical obligation concept.
  • OPA: Flexible code-driven policies, but notoriously difficult to manage at scale with dynamic external data.

One of the toughest challenges is data filtering at scale. In datasets with millions of records, evaluating items individually is unsustainable. This is why I chose XACML as the foundation for Clear Entitlement—leveraging obligation filters to inject security constraints directly into the query itself.

Clear Entitlement combines the proven XACML model with NGAC's relationship-based insights, enabling organizations to define their own data models with UI elements automatically generated from JSON Schema.

Developer-First APIs for UI & Data Filtering
Easy-to-Master Rule Expression Grammar
Extensible Plugin Architecture for Data & Logic
PDP / Runtime

The Engine: Entitlement Service

The core policy decision point (PDP) designed for high-throughput, low-latency authorization across distributed environments.

Functional Entitlement

Real-time control over application features, UI components, and API endpoints, ensuring users only interact with authorized resources.

Data-Level Entitlement

Transactional data access control, usually ABAC.

Obligation Engine

Native support for security filters for data redaction, masking, etc.


PAP / Management

The Console: Entitlement Admin

A centralized orchestration hub for policy administration, application registry, and organizational visibility.

Enterprise Orchestration

The Admin Console provides a single source of truth for your entire security landscape. Administrators can manage application lifecycle, register new services, and monitor policy distribution from an intuitive dashboard.

Admin Console Management

Precision Rule Authoring

The granular policy editor enables teams to define resource hierarchies, action scopes, and complex rules and obligations without deep knowledge of proprietary languages.

Policy Editing Interface
Founder's Note

Architecting for Reality

"Clear Entitlement was born from the realization that standard policy models often fail in the face of enterprise complexity. We've built a system that doesn't just evaluate 'Allow' or 'Deny'—it actively shapes data and application behavior at scale, providing the deterministic safety necessary for modern, high-stakes environments."