Casbin

Casbin is a powerful and efficient open-source access control library. It provides support for enforcing authorization based on various access control models like ACL, RBAC, ABAC for Golang, Java, Node.js, PHP, Python, .NET (C#), Delphi and Rust.

What Casbin does:

• Enforce the policy in the classic {subject, object, action} form or a customized form as you defined, both allow and deny authorizations are supported.
• Handle the storage of the access control model and its policy.
• Manage the role-user mappings and role-role mappings (aka role hierarchy in RBAC). Support built-in superuser like root or administrator.
• A superuser can do anything without explict permissions.
• Multiple built-in operators to support the rule matching. For example, keyMatch can map a resource key /foo/bar to the pattern /foo*.

What Casbin does NOT do:

• Authentication (aka verify username and password when a user logs in) Manage the list of users or roles. I believe it's more convenient for the project itself to manage these entities.
• Users usually have their passwords, and Casbin is not designed as a password container. However, Casbin stores the user-role mapping for the RBAC scenario.

For more details, see: casbin.org/