Relationship-based access control

In computer systems security, Relationship-based access control (ReBAC) defines an <a href="/facts/Authorization/FYFAkCH2">authorization</a> paradigm where a subject's permission to access a resource is defined by the presence of relationships between those subjects and resources.
In general, authorization in ReBAC is performed by traversing the <a href="/facts/Directed_graph/YBdfQ0um">directed graph</a> of relationships. The nodes and edges of this graph are very similar to triples in the <a href="/facts/Resource_Description_Framework/WMufyukm">Resource Description Framework (RDF)</a> data format. ReBAC systems allow hierarchies of relationships, and some allow more complex definitions that include algebraic operators on relationships such as union, intersection, and difference.
ReBAC gained popularity with the rise of social network web applications, where users need to control their personal information based on their relationship with the data receiver rather than the receiver’s role. Using ReBAC enabled to collectively define permissions for teams and groups, thus eliminating the need to set permissions individually for every resource.
In contrast to <a href="/facts/RBAC/dPN1ohBE">role-based access control (RBAC)</a>, which defines roles that carry a specific set of privileges associated with them and to which subjects are assigned, ReBAC (like ABAC), allows defining more fine-grained permissions. For example, if a ReBAC system defines resources of type document, which can allow one action editor, if the system contains the relationship ('alice', 'editor', 'document:budget'), then subject Alice can edit the specific resource document:budget. The downside of ReBAC is that, while it allows more fine-grained access, this means that the application may need to perform more authorization checks.
ReBAC systems are deny-by-default, and allow building RBAC systems on top of them.

Relationship-based access control open-in-new

Relationship-based access control