How to Configure Windows Sandbox Local OpenFGA Fine-Grained Authorization via XML in Windows 11

Relationship-Based Access Control (ReBAC)—inspired by Google Zanzibar whitepaper—has become the modern standard for fine-grained authorization in complex multi-tenant applications. OpenFGA (an open-source project hosted under the Cloud Native Computing Foundation) provides high-performance relationship tuple evaluation and authorization modeling. Testing OpenFGA authorization models, tuple assertions, and check API latency directly on a developer workstation often causes port conflicts and database clutter. In Windows 11, Windows Sandbox provides a pristine, isolated testing platform. By authoring custom Windows Sandbox XML (.wsb) configuration files, you can deploy a disposable OpenFGA authorization engine in seconds.

Architecture of the Disposable OpenFGA Sandbox

Windows Sandbox provides a disposable, hypervisor-isolated guest environment that resets completely upon termination. To provision an automated OpenFGA instance, the architecture requires:

• A mapped host folder: A directory containing the standalone openfga.exe binary and sample authorization model DSL files.
• A WSB configuration file: An XML blueprint that mounts the mapped directory and initiates the engine automatically via LogonCommand.

Authoring the Windows Sandbox WSB Blueprint

Create a working directory on your host machine, such as C:\SandboxOpenFGA. Download the Windows binary of OpenFGA into this folder, then create RunOpenFGA.wsb with the following XML code:

<Configuration>
  <VGpu>Default</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxOpenFGA</HostFolder>
      <SandboxFolder>C:\OpenFGAFiles</SandboxFolder>
      <ReadOnly>false</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\OpenFGAFiles\Start-OpenFGA.ps1</Command>
  </LogonCommand>
</Configuration>

Authoring OpenFGA Startup Script

Inside the mapped host folder (C:\SandboxOpenFGA), create the PowerShell initialization script named Start-OpenFGA.ps1:

Write-Host "=============================================" -ForegroundColor Cyan
Write-Host " Starting OpenFGA Authorization in Sandbox.. " -ForegroundColor Green
Write-Host " HTTP API: http://127.0.0.1:8080/healthz     " -ForegroundColor Yellow
Write-Host " gRPC API: 127.0.0.1:8081                    " -ForegroundColor Yellow
Write-Host " Playground: http://127.0.0.1:3000          " -ForegroundColor Yellow
Write-Host "=============================================" -ForegroundColor Cyan

# Launch OpenFGA in memory storage mode with playground enabled
& "C:\OpenFGAFiles\openfga.exe" run --datastore-engine memory --playground-enabled=true --playground-port 3000

Running and Validating Authorization in the Sandbox

Double-click RunOpenFGA.wsb on your Windows 11 host. Windows Sandbox boots up, mounts the mapped folder, and immediately launches OpenFGA inside an interactive PowerShell window.

The engine starts listening on port 8080 for HTTP API calls, port 8081 for gRPC, and port 3000 for the OpenFGA Playground. Open Microsoft Edge inside the sandbox and navigate to http://127.0.0.1:3000 to access the visual authorization modeling playground.

You can author Zanzibar-style relationship models, insert test user-object tuples, run check queries (e.g. “Can user Alice view document 10?”), and benchmark check latency in total isolation. When testing concludes, closing the sandbox window instantly eliminates all memory datastores, relation tuples, and background processes, leaving your host workstation completely untouched.