02.03 · Concept
Fine-Grained Authorization & ReBAC
Model a Drive-style sharing rule as relationships rather than roles, and say what a Zanzibar-derived system buys you over a permissions column.
Drive-style sharing fits a relationship graph better than a role table: users, groups, folders and documents are connected by facts, then permissions are inferred from those links. A Zanzibar-derived system gives you a central, scalable authorisation service for inheritance, group access, revocation and clean permission checks across services.
What this lesson answers
- how to model document sharing with ReBAC
- ReBAC versus roles for fine grained authorisation
- why use Zanzibar instead of permissions columns
Notes
Fine-grained authorization means answering questions like “can Alice comment on this file?” using the actual object, action, user, and context, not just a broad role such as admin or member. Relationship-based access control models permissions as a graph: Alice is an owner of folder X, file Y is inside folder X, Bob is a viewer of file Y, and viewers may read. A Drive-style sharing rule is naturally a relationship rule: access can come directly from being shared on the document, or indirectly through a parent folder, group membership, or organization membership.
The mental model is a query…
References
Common questions
- What is relationship-based access control?
- Relationship-based access control represents access as connections between subjects and objects. Instead of saying a user has a broad role, it records facts such as a user viewing a document, a document belonging to a folder, or a user belonging to a group. Permission checks ask whether those facts imply a specific action.
- Why is a permissions column not enough for shared documents?
- A permissions column works for simple cases, but it struggles when access is inherited from folders, granted through groups, revoked centrally, or reused by several services. The column becomes a cached answer that must be kept in sync. ReBAC stores the underlying relationships and derives the answer when asked.
- What does a Zanzibar-style authorisation system provide?
- It provides a dedicated service for storing and querying an authorisation graph. Application code asks whether a subject can perform an action on an object, while the service handles relationship traversal, inherited permissions, group membership, caching and consistent answers across the system.
Short definition: what is Fine-Grained Authorization & ReBAC?