Casbin Roadmap

Casbin Roadmap

This document outlines where we're heading with Casbin. Some of these are actively being worked on, others are more exploratory. Contributions and feedback are always welcome!

---

Core Engine Improvements

We're looking at making the core engine more powerful and faster.

• Performance Optimization https://github.com/casbin/casbin/issues/1616 — There's room to squeeze more performance out of enforcement. Precompiling matcher expressions is one idea, but we're open to other approaches too. If you've profiled Casbin and found bottlenecks, let us know.
• Multi-line Matcher Support https://github.com/casbin/casbin/issues/1603 — Right now matchers have to be on a single line which can get ugly when they're complex. We want to support splitting them across multiple lines for better readability.
• Rate Limiting Effect https://github.com/casbin/casbin/issues/1619 — Currently effects are binary (allow/deny). We're exploring adding a rate-based effect so you can say "allow, but only N times per period". This would make Casbin useful for quota enforcement, not just access control.
• Separate Users and Roles https://github.com/casbin/casbin/issues/1621 — In the current model, users and roles are kind of treated the same way. We want to make them more distinct which should make RBAC policies cleaner and easier to reason about.
• Effect Conflict Detector https://github.com/casbin/casbin/issues/1666 — Add a second default detector (EffectConflictDetector) to detect “allow vs explicit deny” conflicts (e.g., a user is allowed directly but denied via a role).

---

Developer Experience

Making Casbin easier to use and integrate.

• Model Builder https://github.com/casbin/casbin/issues/1622 — Writing model files by hand can be error-prone. A programmatic model builder API would help developers construct models in code with proper validation.
• Model Presets https://github.com/casbin/casbin/issues/1623 — Most people use one of a few common patterns (basic RBAC, ABAC, etc). We should ship ready-to-use model presets so you don't have to write the same model.conf from scratch every time.
• Test Helpers https://github.com/casbin/casbin/issues/1624 — Testing authorization logic involves a lot of repetitive Enforce calls with limited failure context. We're thinking about a small authztest package with helpers like AssertAllow(t, e, "alice", "data1", "read") that give better error messages when things fail.

---

Observability

Better insight into what Casbin is doing.

• Logger Interface Refactor https://github.com/casbin/casbin/issues/1601 — The current Logger interface is pretty basic. We want to redesign it to support structured logging, tracing, and metrics. Think OpenTelemetry integration, Prometheus exporters, that kind of thing. This would make debugging production issues much easier.
• Prometheus Logger https://github.com/casbin/casbin/issues/1649 — Implement a PrometheusLogger following the (new/updated) Logger interface; planned to live in a separate repo (casbin-prometheus-logger).

---

Ecosystem & Integrations

Expanding where Casbin can be used.

• MCP Gateway https://github.com/casbin/mcp-gateway/issues/1 — With MCP (Model Context Protocol) becoming a thing for AI tools, we're building a gateway that can authorize MCP requests using Casbin policies. Early days on this one.
• Kubernetes Admission Webhook https://github.com/casbin/casbin-admission-webhook — For folks running Kubernetes, we have an admission webhook that lets you use Casbin policies to control what gets deployed. Still being actively developed.
• Kubernetes CRD-backed Persistence Adapter https://github.com/casbin/casbin/issues/1674 — Add a Go adapter that loads Casbin policy from Kubernetes Custom Resources (CRDs), emphasizing read-only “CRDs as source of truth” behavior and solid testing.
• Kubernetes Informer-based Watcher for CRD Policy Updates https://github.com/casbin/casbin/issues/1675 — Add a watcher that uses Kubernetes informers/watch primitives to react to CRD changes and keep enforcement state updated safely (incl. SyncedEnforcer compatibility and tests).

---

What's Next?

This roadmap isn't set in stone. If there's something you'd like to see, open an issue or start a discussion. PRs are of course welcome for any of the above.