How to implement dynamic RBAC in NestJS?

Casbin provides expressive RBAC/ABAC through policy models (model.conf) and adapters (DB/file), integrated in NestJS via nest-casbin or custom guards checking enforcer.enforce(sub, obj, act). Define roles/policies like admin allow user read/write; load dynamically from Postgres/Redis for hot-updates without restarts. Guards extract subject (user.role), object (resource.id), action (HTTP method) from ExecutionContext; supports ownership checks (user.id === resource.ownerId). Scales to millions of policies; audit logs via middleware.

Example:-

Code

/ roles.guard.ts
@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private casbin: CasbinService) {}
  
  async canActivate(ctx: ExecutionContext) {
    const req = ctx.switchToHttp().getRequest();
    return this.casbin.enforce(req.user.role, req.params.id, req.method);
  }
}

// controller
@Controller('users')
@UseGuards(JwtAuthGuard, RolesGuard)
export class UserController {
  @Get(':id') findOne(@Param('id') id: string) { return { id }; }
}