Fine Grained Authorisation with Relationship-Based Access Control
summary
Relationship-based access control (ReBAC) models permissions as edges between entities so revocation happens automatically when a relationship is removed, not by changing many ACLs. A live demo runs an open-source Permi (open source) server locally, loads a document/user/organization schema, inserts relationships, and issues checks via a Postman collection; queries return allowed/denied with metadata (e.g., check_count 2) and enforce extra rules like on-premises and office-hours. The demo shows schema versioning and snapshot tokens working and successfully answers who can view, edit or delete specific documents.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 2:10Access control basics RBAC
- 5:43Attribute-based access control limitations
- 6:26What is Rebac
- 8:30Entity-attribute-value model under the hood
- 12:02Rebac schema tables
- 17:41Complex permission lookups
- 19:46Hardcoded access rules problems
- 20:29Rebac for document access
- 23:22Rebac use cases
- 25:51Demo setup
- 27:58Tenants and schemas in Permit
- 32:54Defining relationships in Permit
- 35:42Checking permissions with Permit
- 37:45Querying by permissions
- 39:55Summary
related talks
47mFine Grained Authorisation with Relationship Based Access Control
49mFine Grained Authorisation with Relationship-Based Access Control
46mRebuilding Access Management with ReBAC
46mInfuse Business Logic into Permissions with ReBAC
39mSecuring RAG Pipelines with Fine Grained Authorization
45mReBAC at Scale: Let’s Save the p99
25mModernizing Authorization for Cloud Native Applications Using OpenFGA
33mFine-Grained Policies RBAC with OpenFGA