🕸️ FGA / ReBAC lab
Relationship-based access control (Google Zanzibar / OpenFGA). A FIXED model, your own relationship tuples, and a Check that resolves the graph and shows exactly which rule granted.
A tuple is object → relation → subject, e.g. document:roadmap viewer user:priya. A subject can be a userset like group:eng#member. A Check walks the model’s union-of-rewrites over your tuples — direct grants,
computed relations (owner ⟹ viewer) and folder inheritance (parent → viewer). It always
terminates: a visited-set cycle guard plus depth/step fuses.