← All practicals

Model access as relationships (ReBAC)

Write relationship tuples, then prove access with a Zanzibar-style Check that resolves the graph.

1. 1

   Open the FGA lab and click “Seed demo” to see a populated graph (or read the fixed model).

   The authorization model is FIXED data (gdrive-lite): users, groups with nested membership, folders with a viewer-inheriting hierarchy, and documents where owner ⟹ editor ⟹ viewer. The evaluator interprets that model — it hardcodes no rule.

2. 2

   Add at least one relationship tuple (e.g. document:readme viewer user:maya).

   A tuple is object→relation→subject (subject may be a userset like group:eng#member). Tuples are per-user and validated against the model + a strict id charset before they are stored.

3. 3

   Run a Check that RESOLVES TRUE and read the resolution trace.

   The Check walks the model’s union-of-rewrites over your tuples — direct grants, computed relations (owner ⟹ viewer) and folder inheritance (parent → viewer) — and returns a trace showing exactly which rule/tuple granted. It always terminates: a visited-set cycle guard plus depth/step fuses.