Introducing Fine-Grained Authorization for Mastra

Mastra now supports Fine-Grained Authorization (FGA) to precisely manage permissions for authenticated users and the resources they can access. Configure FGA on your Mastra instance to gate every part of the runtime: HTTP routes, agent .stream() and .generate(), workflow runs, tool calls, memory reads and writes, and Mastra-hosted MCP servers.

Mastra had role-based access control (RBAC) since March 2026 (PR #13163) for applying coarse permission patterns to agent calls or memory reads. But restrictions applied by role often aren’t enough. Whilst RBAC handles user vs admin cleanly, it’s not granular enough to fine-tune what specific users can do with specific resources.

FGA lets you refine permissions per-user and per-resource, giving you much more control over what each user can see and do.

You can enable FGA in one of two ways:

• WorkOS: Configure roles in the WorkOS dashboard and use the MastraFGAWorkos provider to apply them to your Mastra server.
• Other auth providers: Implement the IFGAProvider interface — a small vendor-agnostic surface you can point at any authorization backend.