Skip to content

Add comprehensive OpenFGA demo applications showcasing banking and GenAI authorization models#12

Merged
3 commits merged intomainfrom
copilot/fix-4cf6aa16-9dbf-475d-b702-905757710e91
Aug 25, 2025
Merged

Add comprehensive OpenFGA demo applications showcasing banking and GenAI authorization models#12
3 commits merged intomainfrom
copilot/fix-4cf6aa16-9dbf-475d-b702-905757710e91

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Aug 24, 2025

This PR adds two comprehensive demo applications that showcase the OpenFGA operator's capabilities for implementing fine-grained authorization in real-world scenarios: a Banking Application Demo and a GenAI RAG Agent Demo.

Banking Application Demo

Implements a complete banking authorization system with:

  • Hierarchical RBAC: Customer, teller, manager, loan officer, and admin roles with proper inheritance
  • Multi-ownership Support: Joint accounts with multiple owners and co-owners
  • Fine-grained Transaction Controls: Separate permissions for viewing, depositing, withdrawing, and transferring
  • Loan Processing Workflows: Proper authorization chains for loan approval and modification with loan officer oversight
  • Branch-based Security: Employee access limited to their specific branch

The demo includes a comprehensive OpenFGA authorization model with 5 entity types (bank, branch, account, loan, transaction) and realistic relationship definitions using tuple-based permissions.

GenAI RAG Agent Demo

Implements sophisticated authorization for AI-powered knowledge management with:

  • Three-tier Knowledge Management: Curator, contributor, and reader roles with hierarchical permissions
  • Document-level Security: Individual document permissions with inheritance from knowledge base roles
  • Content Filtering for RAG: Responses filtered based on user's document access permissions to prevent data leakage
  • AI Model Access Control: Separate permissions for using and configuring AI models
  • Session-based RAG Authorization: Controlled RAG sessions with participant management and intersection permissions

The demo showcases advanced OpenFGA features including intersection logic where users must have both session access AND document permissions to view RAG results.

Key Features

Both demos demonstrate:

  • Complete OpenFGA Authorization Models in JSON format ready for production deployment
  • Comprehensive Test Coverage with 33 new tests covering positive cases, negative cases, and edge scenarios
  • Realistic Data Models representing actual business entities and relationships
  • Content Filtering Examples showing how to implement document-level security in RAG applications
  • Integration Examples with REST APIs (JavaScript) and Python applications

Files Added

demos/
├── README.md                           # Overview and usage guide
├── banking-app/
│   ├── README.md                       # Banking demo documentation
│   ├── authorization-model.json        # Complete OpenFGA model
│   ├── banking_demo.rs                 # Demo implementation with tests
│   └── openfga-setup.md               # Integration guide
└── genai-rag/
    ├── README.md                       # GenAI demo documentation
    ├── authorization-model.json        # Complete OpenFGA model
    ├── genai_rag_demo.rs              # Demo implementation with tests
    └── openfga-setup.md               # Integration guide

Testing

All tests pass (40 total, including 33 new demo tests):

  • 16 banking authorization tests covering account access, loan processing, and transaction controls
  • 17 GenAI authorization tests covering knowledge base management, document permissions, and RAG filtering
  • Comprehensive edge case testing for unauthorized access scenarios

These demos serve as both educational examples and production-ready templates for implementing OpenFGA authorization in banking and AI applications.


💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

… and tests

Co-authored-by: jralmaraz <13877691+jralmaraz@users.noreply.github.com>
Copilot AI changed the title [WIP] Implement OpenFGA authorization models and tests for demo applications Add comprehensive OpenFGA demo applications showcasing banking and GenAI authorization models Aug 24, 2025
Copilot AI requested a review from jralmaraz August 24, 2025 23:38
…0e91

Signed-off-by: Jose Roberto Almaraz <jralmaraz1@gmail.com>
Copy link
Copy Markdown
Owner

@jralmaraz jralmaraz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Current changes are failing to run status check.

Changes proposed:

CI Workflow (.github/workflows/ci.yml): Fix Rust toolchain setup and Clippy linting errors.
Rust Code (src/main.rs): Refactor code to resolve Clippy errors.
Makefile: Update commands for linting.
README Documentation: Improve documentation to include Rust setup instructions and linting guide.

@jralmaraz jralmaraz closed this pull request by merging all changes into main in ffae191 Aug 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants