Define your own permission keys: invoice.read, report.export, identity.manage. Canopy doesn't assign meaning to them; it enforces them consistently across your hierarchy. Each account defines its own model, completely isolated from every other tenant.
Without dynamic permissions, access checks live in your codebase. Every new feature needs new conditionals, and changing a rule means a deployment.
Permissions follow a predictable pattern, with unlimited depth for complex domains, and categories to keep them organized. The structure is yours to define.
You define permissions, bundle them into roles, then assign roles at nodes. Change the role's permissions and every holder updates instantly.
At runtime, your application asks Canopy: does this user have permission X at node Y? Canopy evaluates direct assignments, inherited roles, and active time windows, then returns a deterministic answer in a single API call.
Direct roles, inherited roles, and time windows in one pass.
The same inputs always return the same answer.
Grant access that starts in the future, expires automatically, or supports temporary roles for contractors. No cleanup required: expired access is ignored automatically at evaluation time.
Check multiple permissions or identities at once. Build permission-aware UIs that show or hide features based on real access, and filter data by scope, without repeated API calls.
| Identity | invoice. approve | report. export | identity. manage |
|---|---|---|---|
| DO D. Okafor | |||
| RT R. Tan | |||
| MK M. Khan |