Access control that's
audit-ready from day one.
Darwan is the authorization and compliance engine for multi-tenant applications. Enforce least privilege, pass compliance audits, and ship access control from a single API — with immutable audit trails, separation of duties, and periodic access reviews built in.
⌐ proofs · last verified 2026-04-13
- Evaluation latency
- < 5 msp95 · RBAC + ABAC · Redis-backed cache
- Audit integrity
- SHA-256 chainper-tenant sequenced · verifiable on demand
- Decision model
- Deny-overridesexplainable · 6 reason codes
- Frameworks
- 7 supportedSOX · SOC 2 · ISO · HIPAA · PCI · GDPR · NIST
- Stack
- .NET 10 · PostgreSQL 18single deployable · Docker-first
Regulatory frameworks supported out of the box
01 / 04 Capabilities
Nine capabilities,
one authorization API.
Not a feature checklist. Each item below is wired into request-handling code that runs in production. Read the source. Audit the logs.
Role-Based Access Control
Define roles, permissions, and assignments across tenants. Deny-overrides-allow evaluation with explainable decisions.
Attribute-Based Policies
Layer fine-grained conditions on top of RBAC. Ownership rules, JSON constraints, and versioned policy sets.
Multi-Tenant by Default
Every entity is tenant-scoped. One Darwan instance serves all your products with isolated data and policies.
Time-Bound Assignments
Set expiration dates on role assignments. Expired grants are automatically excluded from authorization and cleaned up by a background service.
Separation of Duties
Define conflicting role constraints with Block or Warn enforcement. Violations are caught at assignment time across direct and group paths.
Periodic Access Reviews
Create certification campaigns to review all role assignments. Approve or revoke with audit trails. Overdue reviews auto-expire.
Immutable Audit Trails
Every decision is logged with SHA-256 hash chains and per-tenant sequencing. Verify integrity on-demand. Archived, never deleted.
Audit Export & Analytics
Paginated search with filters, summary analytics, and CSV/JSON export. Real-time audit dashboard with integrity verification.
API Keys & Webhooks
Scoped API keys for service-to-service auth. Webhooks push role, policy, and compliance events to every downstream service.
“Most authorization vendors ask you to model policy in their DSL and check your audit trail in their dashboard. We give you the API, the decision log, and the SQL — because that is what an auditor asks for.”
02 / 04 How it works
Three steps.
One decision log.
Define your model once in the console or via API, call /v1/authorize from every service, audit every decision from a single immutable log. No sidecars, no policy language to learn.
Model your access in the admin console or via API. Assign roles with optional expiry dates and Separation-of-Duties constraints.
Darwan evaluates RBAC grants, ABAC policies, and time-bound assignments, then returns an explainable decision in under 5 ms.
POST /v1/authorize
{ "action": "read", "resource": "invoice" }
200 OK { "allowed": true, "reason": "role:finance-reader" }Every decision is hash-chained, sequenced, and archived. Run periodic access reviews, export CSV/JSON, verify integrity on demand.
03 / 04 Regulatory readiness
Seven frameworks.
No bolt-on tools needed.
Darwan provides the controls, audit trails, and review workflows required by major compliance frameworks. Mapped to specific clauses, not brochure claims.
SoD constraints, access reviews, immutable audit logs
Audit trails, access reviews, time-bound access, integrity verification
RBAC, periodic reviews, audit logging, least-privilege enforcement
Access controls, audit logs, automatic session expiry, review certification
Role-based access, SoD, quarterly reviews, audit trail retention
Access control, audit trails, data minimization via expiry, review evidence
RBAC/ABAC, SoD, continuous monitoring, audit integrity, access reviews
04 / 04 Integrate
One HTTP call
from any service.
If your stack speaks HTTP and JSON, Darwan drops in. Official SDKs for .NET, Go, Node.js, and Rust — or hit /v1/authorize directly. Every decision returns a reason code your application can surface to the user.
# Request
POST /v1/authorize HTTP/1.1
Host: darwan.net
Authorization: Bearer <api-key>
Content-Type: application/json
{
"tenantId": "acme-corp",
"principalId": "user-42",
"action": "read",
"resourceType": "invoice",
"resourceId": "inv-2026-0413"
}
# Response — 200 OK
{
"allowed": true,
"reason": "role:finance-reader",
"policyId": "pol_8f2e1c",
"traceId": "01HXYZ...",
"ttlMs": 30000
}Get started
Ship compliant
access control this sprint.
Sign in to start managing roles, enforcing separation of duties, and running access reviews. On-prem, hosted, or hybrid — we work with the deployment model your security team already trusts.