Casbin Roadmap

# Casbin Roadmap

This document outlines where we're heading with Casbin. Some of these are actively being worked on, others are more exploratory. Contributions and feedback are always welcome!

---

## Core Engine Improvements

We're looking at making the core engine more powerful and faster.

* [ ] **Performance Optimization** [https://github.com/casbin/casbin/issues/1616](https://github.com/casbin/casbin/issues/1616) — There's room to squeeze more performance out of enforcement. Precompiling matcher expressions is one idea, but we're open to other approaches too. If you've profiled Casbin and found bottlenecks, let us know.
* [ ] **Multi-line Matcher Support** [https://github.com/casbin/casbin/issues/1603](https://github.com/casbin/casbin/issues/1603) — Right now matchers have to be on a single line which can get ugly when they're complex. We want to support splitting them across multiple lines for better readability.
* [ ] **Rate Limiting Effect** [https://github.com/casbin/casbin/issues/1619](https://github.com/casbin/casbin/issues/1619) — Currently effects are binary (allow/deny). We're exploring adding a rate-based effect so you can say "allow, but only N times per period". This would make Casbin useful for quota enforcement, not just access control.
* [x] **Separate Users and Roles** [https://github.com/casbin/casbin/issues/1621](https://github.com/casbin/casbin/issues/1621) — In the current model, users and roles are kind of treated the same way. We want to make them more distinct which should make RBAC policies cleaner and easier to reason about.
* [ ] **Effect Conflict Detector** [https://github.com/casbin/casbin/issues/1666](https://github.com/casbin/casbin/issues/1666) — Add a second default detector (`EffectConflictDetector`) to detect “allow vs explicit deny” conflicts (e.g., a user is allowed directly but denied via a role).

---

## Developer Experience

Making Casbin easier to use and integrate.

* [ ] **Model Builder** [https://github.com/casbin/casbin/issues/1622](https://github.com/casbin/casbin/issues/1622) — Writing model files by hand can be error-prone. A programmatic model builder API would help developers construct models in code with proper validation.
* [ ] **Model Presets** [https://github.com/casbin/casbin/issues/1623](https://github.com/casbin/casbin/issues/1623) — Most people use one of a few common patterns (basic RBAC, ABAC, etc). We should ship ready-to-use model presets so you don't have to write the same model.conf from scratch every time.
* [ ] **Test Helpers** [https://github.com/casbin/casbin/issues/1624](https://github.com/casbin/casbin/issues/1624) — Testing authorization logic involves a lot of repetitive `Enforce` calls with limited failure context. We're thinking about a small `authztest` package with helpers like `AssertAllow(t, e, "alice", "data1", "read")` that give better error messages when things fail.

---

## Observability

Better insight into what Casbin is doing.

* [ ] **Logger Interface Refactor** [https://github.com/casbin/casbin/issues/1601](https://github.com/casbin/casbin/issues/1601) — The current Logger interface is pretty basic. We want to redesign it to support structured logging, tracing, and metrics. Think OpenTelemetry integration, Prometheus exporters, that kind of thing. This would make debugging production issues much easier.
* [ ] **Prometheus Logger** [https://github.com/casbin/casbin/issues/1649](https://github.com/casbin/casbin/issues/1649) — Implement a `PrometheusLogger` following the (new/updated) Logger interface; planned to live in a separate repo (`casbin-prometheus-logger`).

---

## Ecosystem & Integrations

Expanding where Casbin can be used.

* [x] **MCP Gateway** [https://github.com/casbin/mcp-gateway/issues/1](https://github.com/casbin/mcp-gateway/issues/1) — With MCP (Model Context Protocol) becoming a thing for AI tools, we're building a gateway that can authorize MCP requests using Casbin policies. Early days on this one.
* [x] **Kubernetes Admission Webhook** [https://github.com/casbin/casbin-admission-webhook](https://github.com/casbin/casbin-admission-webhook) — For folks running Kubernetes, we have an admission webhook that lets you use Casbin policies to control what gets deployed. Still being actively developed.
* [ ] **Kubernetes CRD-backed Persistence Adapter** [https://github.com/casbin/casbin/issues/1674](https://github.com/casbin/casbin/issues/1674) — Add a Go adapter that loads Casbin policy from Kubernetes Custom Resources (CRDs), emphasizing read-only “CRDs as source of truth” behavior and solid testing.
* [ ] **Kubernetes Informer-based Watcher for CRD Policy Updates** [https://github.com/casbin/casbin/issues/1675](https://github.com/casbin/casbin/issues/1675) — Add a watcher that uses Kubernetes informers/watch primitives to react to CRD changes and keep enforcement state updated safely (incl. `SyncedEnforcer` compatibility and tests).

---

## What's Next?

This roadmap isn't set in stone. If there's something you'd like to see, open an issue or start a discussion. PRs are of course welcome for any of the above.