Fine-grained authorization — ReBAC in practice

Roles answer questions about people: is Priya an admin? Real products also ask about people and things: can Priya open this invoice? That is fine-grained authorization. Your goal: store "who can do what to which thing" as small facts, and check them one by one.

Roles are not enough

RBAC (role-based access control) answers "what is this person?": admin, agent, viewer. But users create and share things. Then the question is about each thing. Can Priya view invoice-42? Can the auditors group read report-q3? With roles you would need one role per file, such as "invoice-42-viewer". Or you would put if-statements all over your code. Both get out of hand.

Picture a hospital. A staff badge opens the main door. That is a role. But a visitor card says, "Priya may see bed 12 in ward 3." That is one small fact about one thing.

FGA is a form of ReBAC (relationship-based access control). It keeps the facts about who can do what in one dedicated store. The app asks the store one small question per decision. Google Drive works this way. You share a file with people or a team, and the file remembers. Nobody gets a "role" for each document. The idea comes from Google's Zanzibar paper. The open-source engine is OpenFGA.

Tuples: small facts

Every permission is one fact. It is a tuple of (user, relation, object):

user:priya · viewer · doc:invoice-42
group:auditors#member · viewer · doc:report-q3

Sharing means writing a tuple. Revoking means deleting it. You need no redeploy and no code change. An authorization model lists the relations for each object type. A doc has an owner, an editor and a viewer. The model also says how relations imply each other. An owner can do everything a viewer can.

Check: one question per decision

Before the app serves anything protected, it asks the store Check(user, relation, object). The answer is yes or no, in milliseconds. The app stops deciding and starts asking.

Groups and inheritance

A tuple can point at a set of users. group:auditors#member · viewer · doc:report-q3 means "every member of auditors may view this". Join the group and you can see the document. Leave the group and you cannot. Removing a person is one delete. Relations can also flow down. A folder's viewer is a viewer of the documents inside it. Three tuples can replace thousands of grants.