# OpenFGA MCP for AI Agents AI Agent Connect > OpenFGA gives your AI agent the ability to manage Relationship-Based Access Control (ReBAC) directly. Instead of wrestling with complex API calls to define who can see what, you can just tell your agent to update authorization models, manage stores, or check specific user permissions. It's about turning complex security logic into a conversation. ## Overview - **Category:** developer-tools - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_VDWoQMoj6eTPYg6n6XBuedyNPsCIKIje0Bwlugcp/ai-agent-connect - **Tags:** authorization, rebac, access-control, permissions, security-policy, identity-management ## Description Managing permissions in a large system usually involves jumping between different dashboards and writing tedious API requests just to see if a user has access to a specific resource. This Connector changes that by letting you handle your OpenFGA instance through natural conversation. You can ask your agent to build out new authorization models, create isolated stores for different environments, or audit the relationship tuples that govern your security. It handles the heavy lifting of the Zanzibar-inspired logic so you can focus on the actual security policy. When you add this to your toolkit via the Vinkius marketplace, you stop treating authorization as a manual data entry task and start treating it as a dynamic conversation with your infrastructure. You get to verify permissions on the fly and see how your models are behaving without ever leaving your primary workspace. Instead of copy-pasting IDs or manually updating JSON files, you just describe the change you want to make. Your agent handles the communication with the backend, ensuring that your permissions stay accurate and your security posture remains solid. It's about making complex access control feel like a simple conversation. This is especially useful when you need to quickly prototype a new permission set or verify that a specific security rule is actually working as intended. You can query the system to see exactly who has access to what, or even expand a relation into a full tree to visualize the hierarchy of your permissions. By moving these tasks into a chat interface, you reduce the chance of human error and speed up the deployment of new features. You get to manage your security logic with the same ease that you manage your code. ## Tools ### list_authorization_models List authorization models. Use this to see all the security models you have defined. ### list_users List all users who have a relation to an object. This helps you identify everyone with access to a resource. ### read_changes Read changes to relationship tuples. Use this to track updates to your security rules. ### read_tuples Query stored relationship tuples. This lets you see the raw data of your permission links. ### write_authorization_model Write a new authorization model. Use this to define new types and relations for your system. ### write_tuples Add or delete relationship tuples. This is how you grant or revoke specific permissions. ### check_relation Check if a user has a relation to an object. This lets you verify specific permissions instantly. ### create_store Create a new OpenFGA store. Use this to set up isolated environments for different applications. ### delete_store Delete an OpenFGA store. This helps you clean up old environments or test new setups. ### expand_relation Expand a relation into a tree. Use this to visualize the hierarchy of nested permissions. ### get_authorization_model Get a specific authorization model. This lets you see the structure of your security logic. ### get_store Get OpenFGA store details. Use this to check the configuration of a specific environment. ### health_check Check OpenFGA instance health. This helps you ensure your authorization system is running correctly. ### list_objects List all objects a user can access. This is great for auditing what a specific user can see. ### list_stores List all OpenFGA stores. Use this to see all your managed environments at once. ### batch_check_relations Perform multiple checks in one request. Use this to verify many permissions at the same time. ## Prompt Examples **Prompt:** ``` List all my OpenFGA stores. ``` **Response:** ``` I've retrieved your OpenFGA stores. You have 3 stores: * **Staging** (ID: 01H1...) * **Production** (ID: 01H2...) * **Lab** (ID: 01H3...) ``` **Prompt:** ``` Check if user 'anne' has the 'viewer' relation to 'document:doc1' in store 01H1... ``` **Response:** ``` I checked the relation in store 01H1... and the result is **allowed: true**. User 'anne' does have 'viewer' access to 'document:doc1'. ``` **Prompt:** ``` Create a new OpenFGA store named 'Security-Audit-Logs'. ``` **Response:** ``` The store **'Security-Audit-Logs'** has been successfully created with ID: 01J9... ``` ## Capabilities ### Check user permissions Ask your agent if a specific user has the correct access to a document, folder, or any other object. ### Create auth stores Set up isolated environments for different applications or deployment stages with a single command. ### Build authorization models Define the types and relations that govern your system's security logic through natural language. ### Update relationship tuples Add or remove specific user-to-object connections to manage permissions dynamically. ### Monitor instance health Get a quick status update on your OpenFGA setup to ensure your security layer is active. ## Use Cases ### Auditing user access A security engineer asks the agent to list every object a specific user can access to ensure they don't have over-privileged permissions. ### Testing new roles A developer wants to see if a new 'editor' role works. They ask the agent to check the relation for a specific user and document. ### Environment setup A DevOps engineer needs to spin up a new lab environment and asks the agent to create a new store for the test cluster. ### Security policy audit A security lead asks the agent to expand a relation into a tree to visualize how nested permissions are flowing through the system. ## Benefits - Verify permissions instantly without writing custom API scripts or manual queries. - Build and iterate on complex authorization models using simple natural language instructions. - Manage multiple environment stores in one place to keep your staging and production logic separate. - Audit user access across your entire system by listing all objects a user can see. - Keep your security posture accurate by tracking changes to relationship tuples in real time. - Ensure high availability by monitoring your instance health through a simple chat command. ## How It Works The bottom line is you get to manage complex ReBAC permissions through a chat interface instead of manual API calls. 1. Connect your OpenFGA API URL and token to the Connector. 2. Open your preferred AI client like Claude or Cursor. 3. Ask the agent to list your stores or check a specific permission. ## Frequently Asked Questions **How does OpenFGA help with my application permissions?** It allows you to manage complex permissions based on relationships. Instead of just checking roles, it checks how users and objects are connected, which is ideal for systems with complex sharing rules. **Can I use OpenFGA for different environments?** Yes, you can create isolated stores for different environments like staging, production, and development. This keeps your security logic separate and organized. **How do I check if a user has access to a specific resource?** You can simply ask your agent to check the relation for you. It will query the system and tell you immediately if the user is allowed to see or modify that specific object. **What is a relationship tuple in OpenFGA?** A relationship tuple is a way to define a link between two entities, like a user and a document. It tells the system that a specific connection exists, which the system then uses to calculate permissions. **Is OpenFGA good for scaling large systems?** Yes, it's inspired by Google's Zanzibar, which was built to handle permissions at massive scale. It's designed specifically for high-performance, fine-grained authorization. **Can I manage multiple stores at once?** Yes, you can list all your stores and switch between them easily using natural language commands. This makes managing multi-tenant or multi-environment setups much faster. **How can I check if a specific user has access to a resource?** You can use the `check_relation` tool. Provide the store ID and the relationship details (user, relation, and object) to get an immediate boolean response on whether the access is permitted. **Can I see the history of changes made to relationship tuples?** Yes, the `read_changes` tool allows you to retrieve the changelog of relationship tuples for a specific store, optionally filtered by object type. **How do I define a new authorization model?** Use the `write_authorization_model` tool. You will need to provide the store ID, the schema version, and a JSON array of type definitions that describe your relations.