Blog

Authorization Models: RBAC, ABAC, ReBAC and Permission-Based Design in Multi-Tenant Scenarios

Stuffing conditions into roles leads to role explosion; the fix is to use RBAC, ABAC and ReBAC as layers. We reduce roles to permission bundles, write the refund rule as a policy that returns reasoned decisions from tenant, limit and time attributes, show the Zanzibar idea with a toy relationship graph, pin it all with tests, and discuss permissions in tokens, the tenant claim and auditing impersonation.