Authorization is infrastructure.
Amsonia Core treats tenant isolation and delegated access as security boundaries, not conventions left to each handler. It provides a standalone Go API, PostgreSQL adapter and migrations, an in-memory adapter for tests, an operator CLI, and a React administration console.
Built for one specific job.
Core fits Go/PostgreSQL teams building multi-tenant SaaS that want RBAC and tenant storage isolation to share one inspectable, self-hosted boundary. The host still authenticates end users, selects the active tenant, loads business resources, and maps operations to permissions.
It is not an OAuth/OIDC identity provider, a general-purpose relationship graph, or a hosted authorization control plane. That narrower boundary is intentional.
Signed context
Tenant context is bound per transaction and invalid context yields no tenant rows.
Delegated RBAC
Permission catalogs, scoped grants, immutable role versions, and grant-cycle protection.
Admin identity
Argon2id credentials, lockout, rotating refresh sessions, and one-time bootstrap.
Audit history
Append-only events make policy changes and authorization operations reviewable.
Small surfaces. Explicit adapters.
The reusable kernel is separated from storage and HTTP composition. Teams can start with the in-memory adapter, run the complete PostgreSQL implementation, or extend the published interfaces without importing the commercial application.
cmd/api standalone HTTP API
cmd/amsonia migrations and administrator CLI
postgres adapter, migrations, and RLS tests
memory in-memory adapter for tests
internal/coreapp identity, session, tenant, and HTTP composition
web React management console
openapi versioned HTTP contractProtect application-owned rows
postgres.Store.RunTenant can also wrap host business-table queries when those tables opt into the same signed RLS policy. The public invoice example proves two-tenant reads without tenant predicates, rejected cross-tenant writes, and zero visible rows for forged context.
Choose by boundary, not feature count.
| Approach | Best fit | Data isolation |
|---|---|---|
| Amsonia Core | Go SaaS tenant RBAC, sessions, audit | Signed context plus forced PostgreSQL RLS |
| Policy library | Application-specific RBAC or ABAC | Designed separately by the application |
| Relationship service | Fine-grained object graphs | Application database remains separate |
| Identity platform | Login, federation, user lifecycle | Depends on product and integration |
Core is deliberately smaller than Amsonia.
Core includes identity, sessions, tenants, memberships, roles, permissions, authorization decisions, and policy audit. Billing, commerce, AI, education, messaging, media, and white-label operations remain in Amsonia Platform.