New Access Controls for Okta FGA Using Per-Module Authorization

We are excited to introduce the Per-Module Authorization feature. This enables large organizations to securely share authorization models by specifying which application credentials can update data for specific modules.

Teams that are responsible for their own separate services can now limit access to modification of authorization data on a per-module basis. Last year, we released Modular Models, where a single model could be separated into modules across multiple files, allowing teams to use features in their source code management platforms (such as GitHub’s CODEOWNERS feature) to enforce access on who can modify parts of a model.

Per-Module Authorization builds on top of that work to further define permissions for applications. Workflows can be implemented where different teams maintain their portion of an FGA model independently and also ensure that the services and applications owned by the respective teams can only modify their own authorization data.

For more details, refer to Okta FGA’s documentation on how to grant client credentials access to only specific modules.