Mizan

Inspiration

Authorization is rebuilt inside almost every application. Roles, permissions, direct grants, denials, temporary access, schedules, and custom database schemas are often implemented differently in every project.

We wanted a small, reusable TypeScript authorization layer that does not force a database schema, ORM, authentication provider, or cache. Mizan is built around one principle: adapters provide authorization facts, and Mizan makes the final decision.

What it does

Mizan evaluates role grants, direct grants, denial overrides, wildcard permissions, scopes, validity windows, recurring schedules, and facts from multiple sources. It returns an explainable allow or deny decision with a stable reason code.

The interactive demo shows Super Admin, Admin, and Support principals. It demonstrates protected car actions, schedule-controlled Admin deletion, Support denial overrides, policy management, a controllable evaluation clock, and the difference between UI presentation and real authorization enforcement.

Mizan is an authorization layer, not an authentication system. The host application remains responsible for users, sessions, JWTs, cookies, persistence, revocation, caching, and server-side enforcement.

How we built it

Mizan is a fixed-version TypeScript monorepo with a runtime-neutral core and an in-memory reference adapter. The core does not own an application schema or storage system. Adapters translate each application’s data into authorization facts.

For Build Week, Codex and GPT-5.6 were used as the planning, architecture, task-decomposition, review, and verification layer. The human builder owned the product direction, engineering decisions, acceptance criteria, trade-offs, and final review.

Coding-capable worker agents and models carried out implementation tasks under those decisions. Codex provided the shared engineering workspace and workflow used to coordinate the work, run checks, and review the results. It was not presented as the sole author of the implementation.

Challenges we ran into

The main challenge was supporting existing applications without forcing them to rename tables or adopt a new ORM. We also needed clear precedence rules so an explicit denial overrides a grant, while temporal and scheduled decisions remain predictable.

Using multiple AI agents introduced another challenge: generated code still required acceptance criteria, tests, review, and human judgment. We established a workflow with focused tasks, automated checks, adversarial review, and final approval.

Accomplishments that we're proud of

• A reusable authorization core without ORM or authentication coupling.
• A memory adapter that serves as a reference for custom adapters.
• Support for grants, denials, scopes, temporal windows, schedules, and multiple sources.
• Explainable decisions with stable denial reasons.
• An interactive browser demo that exercises the real Mizan evaluator.
• A fixed-version monorepo ready for future integrations.
• A documented collaboration workflow using Codex, GPT-5.6, and specialized coding agents.

What we learned

We learned that the most reusable abstraction is a capability boundary rather than a database schema: adapters provide facts, and the authorization engine makes the final decision.

We also reinforced that hiding or disabling a browser button is only a user-experience decision. Protected operations must be checked again at the server or API boundary.

Finally, we learned that AI-assisted development works best with clear milestones, narrow tasks, automated tests, adversarial review, and a final human decision.

What's next for Mizan

We will keep the v0.1 decision core stable while improving adapter ergonomics and examples. Planned next steps include tested integrations for common databases and frameworks, composed sources for database/cache/revocation workflows, resource-aware and tenant-aware authorization, optional policy import and audit tooling, and stable fixed-version releases as the API matures toward v1.

Built With

• bun
• chatgpt
• codex
• pi
• typescript