✳flâneur — a map of the web's best reading

Authorization Academy - Relationship-Based Access Control (ReBAC)

osohq.com · 5,216 words · saved by 1 readers

Relationship-based authorization, or ReBAC, means organizing permissions based on relationships between resources. For instance, allowing only the user who created a post to edit it. Relationships include data ownership, parent-child relationships, groups, and hierarchies. Google Zanzibar is a system to manage relationship-based authorization, and we'll explain how it works and when you should use it. Welcome to chapter four of Authorization Academy! You might have come straight from the earlier chapter, or maybe it’s been a little while. In either case, let’s do a quick recap: If you’re new to authorization models, we recommend going through these two guides first. We’ll be talking about relationships in this guide, and thinking about roles as a type of relationship is a great starting point. In this chapter, we’re going to talk about relationships and the notion of relationship-based access control or ReBAC. From an implementation standpoint, relationships look very much like roles.

Authorization Academy - Relationship-Based Access Control (ReBAC) Your employees ignore 96% of their permissions. Agents won't. → Read the research Company Book a demo Oso Authorization Academy Chapter V: Relationship-Based Access Control (ReBAC 1. Our Second Authorization Model: Relationships Relationship-Based Access Control (reBAC) Versus Attribute-based Access Control (ABAC) 2. Relationship-Based Access Control Models Data ownership Parent-child resources User groups Hierarchies, aka “Recursive Relationships” Implementing the logic of relationship-based access control 3. One ReBAC to rule

Explore this link on the map →

related reading