---
id: "auth/index"
title: "Authentication & Authorisation"
---

# Authentication & Authorisation

> **Implementation status**
>
> The [shared access policy](/docs/auth/access-policy), Titan JWT/session adapters and Netron authorization gates are implemented. Pages explicitly marked Design RFC describe additional application architecture. The current Omnitron daemon ships JWT issuance, session lifecycle, and the `admin`, `operator` and `viewer` roles (see `OmnitronAuth` in [services-reference](/docs/omnitron/services-reference#omnitronauth--authrpc-servicets)). These pages describe the broader application authorisation design. See [operator authentication](/docs/omnitron/auth-rbac) for the implemented daemon role checks.

The Titan/Omnitron auth surface is split into four layers. Each
layer is independently composable; the page you're reading next
should be picked by what you're trying to do.

| If you want to…                                             | Start here                                                            |
| ----------------------------------------------------------- | --------------------------------------------------------------------- |
| Share roles and permissions between server and UI           | [Shared access policy](/docs/auth/access-policy)                      |
| Verify a JWT and resolve a user                             | [`@titan-auth` JWT primitives](/docs/titan/modules/auth)              |
| Gate an RPC method on a role / permission / policy          | [`@Auth` decorator & PolicyEngine](/docs/titan/netron/authentication) |
| Compose a permission string (grammar, wildcards, hierarchy) | [Permissions](/docs/auth/permissions)                                 |
| Grant a permission to a single user on top of their role    | [Per-user overrides](/docs/auth/overrides)                            |
| Apply attribute-based conditions (time window, MFA, IP)     | [ABAC conditions](/docs/auth/abac-conditions)                         |
| Project the auth context onto a `@kysera/rls` policy        | [RLS bridge](/docs/auth/rls-bridge)                                   |
| Capture every authorisation decision for audit              | [Audit trail](/docs/auth/audit-trail)                                 |
| Get tokens to the client — cookies or bearer, and CSRF      | [Token issuance & transports](/docs/auth/token-issuance)              |
| Understand how the four layers fit together                 | [Mental model](/docs/auth/mental-model)                               |
| Migrate from `@RequireRole(...)` to permission strings      | [Migration: auth v1 → v2](/docs/titan/migrations/auth-1-to-2)         |

## Reading order for first-time integrators

1. **[Mental model](/docs/auth/mental-model)** — one page, one diagram,
   how roles / permissions / conditions / RLS combine.
2. **[Permissions](/docs/auth/permissions)** — grammar, wildcards,
   hierarchical prefix grant. Read once, reference forever.
3. **[`@titan-auth`](/docs/titan/modules/auth)** — set up the
   JWT verifier and the `@Auth` decorator.
4. **[ABAC conditions](/docs/auth/abac-conditions)** when you need
   gates beyond role/permission (time of day, MFA-stepped-up,
   request IP, feature flag).
5. **[RLS bridge](/docs/auth/rls-bridge)** when your gates also need
   to apply at the database layer.
6. **[Audit trail](/docs/auth/audit-trail)** when you need to prove,
   after the fact, that a decision was made the way it was.

Every page links back to the runnable examples in
[`recipes/api-service`](/docs/titan/recipes/api-service) and
[`recipes/multi-tenant-saas`](/docs/titan/recipes/multi-tenant-saas).