<commit_before>---
description: Understand the differences between Auth0's core RBAC release and the Authorization Extension.
toc: true
topics:
  - authorization
  - authorization-extension
  - rbac
  - roles
  - permissions
  - policies
  - rules
  - extensions
contentType: 
    - concept
useCase:
  - build-an-app
  - call-api
  - secure-api
---
# Authorization Core vs. Authorization Extension

Auth0 currently provides two way of implementing [role-based access control (RBAC)](/authorization/concepts/rbac): our Core implementation, which is currently being released, and our Authorization Extension, which will eventually be deprecated. Our Core implementation improves performance and scalability and will eventually provide a more flexible RBAC system than the Authorization Extension.

While we recommend using the RBAC features present in the Authorization Core, we recognize that some implementations may require use of the Authorization Extension until Authorization Core features match its full functionality. To help you decide which feature is right for your implementation, we present the differences between the two:

| Feature | Authorization&nbsp;Core | Authorization&nbsp;Extension |
|---------|-------------------------|------------------------------|
| **<dfn data-key="role">Roles</dfn>** |
| Create/edit/delete roles | Yes | Yes |
| Search roles by name | In future release | Yes |
| Roles can contain permissions from one or more APIs | Yes | No |
| Roles can be assigned to groups | In future release | Yes |
| Roles are attached to specific applications | No | Yes |
| Roles can contain permissions from any application | Yes | No |
| Roles can be nested and are hierarchical | In future release | No |
| Roles can be assigned across multiple tenants | To be determined | No |
| View permissions by role | Yes | Yes |
| View users by role | Yes | Yes |
| **Users** |
| Create/edit/delete users | Yes | Yes |
| Search users by user, email, connection | Yes | Yes |
| Search users by identity provider, login count, last login, phone number | Yes | No |
| Search users using lucene syntax | Yes | No |
| Users can be assigned to roles | Yes&nbsp;-&nbsp;up&nbsp;to&nbsp;50&nbsp;roles&nbsp;per&nbsp;user | Yes |
| Users can be assigned to groups | In future release | Yes |
| View roles by user | Yes | Yes |
| View permissions by user | Yes | Yes |
| Automatic sync between user permissions and user profile | In future release | No |
| **Permissions** |
| Create/edit/delete permissions | Yes | Yes |
| Search permissions by name, description | In future release | Yes |
| Permissions can be assigned directly to users | Yes | No |
| Permissions can be assigned directly to roles | Yes | Yes |<commit_msg>Fix authz typo after stray revert (#8295)<commit_after>---
description: Understand the differences between Auth0's core RBAC release and the Authorization Extension.
toc: true
topics:
  - authorization
  - authorization-extension
  - rbac
  - roles
  - permissions
  - policies
  - rules
  - extensions
contentType: 
    - concept
useCase:
  - build-an-app
  - call-api
  - secure-api
---
# Authorization Core vs. Authorization Extension

Auth0 currently provides two ways of implementing [role-based access control (RBAC)](/authorization/concepts/rbac): our Core implementation, which is currently being released, and our Authorization Extension, which will eventually be deprecated. Our Core implementation improves performance and scalability and will eventually provide a more flexible RBAC system than the Authorization Extension.

While we recommend using the RBAC features present in the Authorization Core, we recognize that some implementations may require use of the Authorization Extension until Authorization Core features match its full functionality. To help you decide which feature is right for your implementation, we present the differences between the two:

| Feature | Authorization&nbsp;Core | Authorization&nbsp;Extension |
|---------|-------------------------|------------------------------|
| **<dfn data-key="role">Roles</dfn>** |
| Create/edit/delete roles | Yes | Yes |
| Search roles by name | In future release | Yes |
| Roles can contain permissions from one or more APIs | Yes | No |
| Roles can be assigned to groups | In future release | Yes |
| Roles are attached to specific applications | No | Yes |
| Roles can contain permissions from any application | Yes | No |
| Roles can be nested and are hierarchical | In future release | No |
| Roles can be assigned across multiple tenants | To be determined | No |
| View permissions by role | Yes | Yes |
| View users by role | Yes | Yes |
| **Users** |
| Create/edit/delete users | Yes | Yes |
| Search users by user, email, connection | Yes | Yes |
| Search users by identity provider, login count, last login, phone number | Yes | No |
| Search users using lucene syntax | Yes | No |
| Users can be assigned to roles | Yes&nbsp;-&nbsp;up&nbsp;to&nbsp;50&nbsp;roles&nbsp;per&nbsp;user | Yes |
| Users can be assigned to groups | In future release | Yes |
| View roles by user | Yes | Yes |
| View permissions by user | Yes | Yes |
| Automatic sync between user permissions and user profile | In future release | No |
| **Permissions** |
| Create/edit/delete permissions | Yes | Yes |
| Search permissions by name, description | In future release | Yes |
| Permissions can be assigned directly to users | Yes | No |
| Permissions can be assigned directly to roles | Yes | Yes |
{'fraction_non_alphanumeric': 0.10143871790202148, 'fraction_numerical': 0.00218539428155163, 'mean_word_length': 3.69803250641574, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '525154', 'n_tokens_mistral': 1397, 'n_tokens_neox': 1352, 'n_words': 666}