Authentication & Authorization

Thena Platform implements a robust security model based on Google’s Zanzibar authorization system, providing enterprise-grade security with fine-grained access control.

​

Authentication

​

User Authentication

curl -X POST https://api.thena.ai/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "your-password"}'

​

Authentication Methods

1. JWT-Based Authentication

   • Secure token-based authentication
   • Configurable token expiration
   • Refresh token support

2. SSO Integration

   • SAML 2.0 support
   • OpenID Connect
   • Custom SSO providers

3. API Key Authentication

   • Secure machine-to-machine communication
   • Rate limiting and usage tracking
   • Key rotation policies

​

Authorization

​

Zanzibar-Style Authorization

Thena Platform uses a Zanzibar-inspired authorization system that provides:

1. Fine-Grained Access Control

   • Object-level permissions
   • Relationship-based access
   • Dynamic permission evaluation

2. Permission Types

   • Direct permissions
   • Inherited permissions
   • Computed permissions

3. Access Levels

   • View
   • Edit
   • Admin
   • Custom roles

​

Permission Model

{
  "subject": {
    "type": "user",
    "id": "user123"
  },
  "object": {
    "type": "ticket",
    "id": "ticket456"
  },
  "relation": "can_view",
  "inheritance": ["team_member", "organization_admin"]
}

​

Scope Evaluation

The platform performs runtime scope evaluation to determine:

1. User Context

   • Current organization
   • Team memberships
   • Role assignments

2. Resource Access

   • Direct permissions
   • Inherited permissions
   • Temporary access grants

3. Action Authorization

   • Operation-specific checks
   • Conditional logic
   • Policy enforcement

​

Best Practices

​

Security Implementation

1. Token Management

   • Implement secure token storage
   • Regular token rotation
   • Proper token validation

2. Permission Design

   • Follow principle of least privilege
   • Group related permissions
   • Regular permission audits

3. Error Handling

   • Proper authentication errors
   • Clear authorization messages
   • Secure error logging

​

Integration Guidelines

1. API Security

   • Use HTTPS only
   • Implement rate limiting
   • Validate all inputs

2. Client Implementation

   • Secure credential storage
   • Token refresh handling
   • Error recovery

​

Common Use Cases

​

Multi-Tenant Security

{
  "policy": "organization_isolation",
  "rules": [
    {
      "resource": "*",
      "effect": "deny",
      "condition": "resource.org_id != user.org_id"
    }
  ]
}

​

Team-Based Access

{
  "team_policy": {
    "inherit_from": "organization",
    "override": {
      "tickets": {
        "view": "team_members",
        "edit": "team_leads"
      }
    }
  }
}

​

Next Steps

• Learn about Permission Management
• Explore Organization Settings
• Review Security Best Practices