IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Modeling permissions as a graph
Maya owns a report. The report sits in a folder. Sam was shared in. Google Drive works the same way: a file inside a shared family folder opens for the whole family. You can write this as a few small facts that a machine follows in microseconds. Your goal: model permissions with the fewest links that still give every answer right.
- A tuple is one stored fact: subject, relation, object.
- A stronger relation implies a weaker one: owner, then editor, then viewer.
- A folder's viewers can also see its files.
- Grant to groups, not to each person.
- A Check asks "can this user do this?" A graph can also list everything.
The words
The open-source OpenFGA project gives us the words for this. A type definition names a kind of object and the relations it can have. A document has owner, editor and viewer. A folder has parent and viewer. Nothing is granted yet. This is only the shape.
Access is stored as relationship tuples. A tuple is a tiny fact: (subject, relation, object). For example, (user:maya, owner, doc:report) means "Maya owns the report." Each tuple is one link in the graph. To give access, you write a tuple. To take it back, you delete it.
Fewer tuples with computed relations
You could write viewer, editor and owner tuples for every user. That is tuple explosion, like role explosion. Instead, computed relations let a stronger relation imply a weaker one: owner ⇒ editor ⇒ viewer. Store only (user:maya, owner, doc:report). Maya is then an editor and a viewer too. One fact gives three answers.
Inherited relations and groups
Inherited relations pass across objects. A folder's viewer is also a viewer of every file inside it. Two tuples are enough: (folder:q3, parent, doc:report) and (group:finance#member, viewer, folder:q3). The whole finance team can read the report, and no tuple names the file.
The subject group:finance#member is a userset: everyone who is a member of group finance. Grant to the group, not to each person. A new hire then needs one membership link, not fifty grants.
water pipes. You do not run a separate pipe to every tap. One main pipe feeds each floor. When a tenant leaves, you close one valve, not a hundred taps.
doc:report, yet the walk finds him a viewer.Asking the graph
A Check is a yes-or-no question: "Can Sam view doc:report?" The engine follows links until it finds a path or runs out. A list-objects question asks for everything: "Which documents can Sam view?" A graph answers both. Some facts are not stored. One example is "this request comes from the trusted network now." For these, send a contextual tuple with the check. It counts for that one call only and is never stored.
Aim for the fewest tuples that make every needed check pass. Grant to groups, not people. Then your model stays small, fast and easy to revoke. Fine-grained authorization shows this graph protecting AI and RAG data. The models lesson helps you decide when a graph is the right tool.
Go deeper: real engines that work this way
OpenFGA is open source and became a CNCF Incubating project in October 2025. SpiceDB, from AuthZed, is another open-source engine built on Zanzibar. Both store tuples and answer Check questions. A real tool writes object names as type:id, so doc:report here is document:report there. In OpenFGA, the document part of our model is written like this:
| Line of the model | What it says |
|---|---|
type document | A kind of object. |
define parent: [folder] | A document can point to a parent folder. |
define owner: [user] | A user can be an owner. |
define editor: [user] or owner | An owner is also an editor. |
define viewer: [user] or editor or viewer from parent | Editors are viewers. So are the viewers of the parent folder. |
OpenFGA can also attach a condition to a tuple, such as a time window. That is a stored cousin of the contextual tuple.
🧪 Interactive lab — enable JavaScript to play with this one.
Drawing a real permission graph and want a second pair of eyes? Talk to our team about ReBAC and fine-grained authorization.