Term · 2. Authentication & Authorization
Relationship-Based Access Control ReBAC
Relationship-based access control (ReBAC) grants access based on relationships between subjects and resources — a user can edit a document if they own the folder it lives in. Popularized by Google's Zanzibar model, ReBAC excels at hierarchical and shared-resource permissions in collaboration, social and SaaS products. It answers whether a user is related to an object in a way that permits the action, rather than checking roles or attributes alone.
Definition
Authorization model where access decisions are derived from relationships between subjects and objects in a graph (e.g. "owner of", "member of team that manages", "manager of"). Popularised by Google Zanzibar and implementations such as OpenFGA / SpiceDB. Complements RBAC, ABAC, and PBAC — well suited to fine-grained, hierarchical and ownership-based permissions in modern applications.
- Application
- midPoint: relationship-derived authorization can be expressed in midPoint via object references and mapping expressions, complementing the primary RBAC model.
- Sources
Related terms
-
Access Control (AC)
Mechanism that determines whether a principal is permitted to perform a specific action on a specific resource. Includes …
-
Access Management (AM)
Discipline of granting and enforcing access to resources after identity has been established. Encompasses authentication …
-
Access Object
Access Object — a unit of an information resource for which access is regulated by access control rules. May be a file, …
-
Access Subject
Access Subject — a person or process whose actions are regulated by access control rules to information system objects. …
-
Attribute-Based Access Control (ABAC)
Authorization model evaluating attributes of subject (role, department, clearance), object (sensitivity, owner), action …
-
Authorization (AuthZ)
Process of deciding whether an authenticated principal is permitted to perform a requested action on a resource. Distinc …
Frequently asked questions
What is ReBAC best for?
ReBAC fits products with nested ownership and sharing — documents, folders, repositories, org hierarchies — where permissions flow along relationships. It is the model behind Drive-style sharing and is implemented by systems like OpenFGA and SpiceDB.
ReBAC vs RBAC vs ABAC?
RBAC uses roles, ABAC uses attribute rules, ReBAC uses graph relationships. They overlap: ReBAC can be seen as ABAC where the key attribute is a relationship. Choose ReBAC when who is connected to what is the natural way to express access.
What is Google Zanzibar?
Zanzibar is Google's global authorization system that stores relationships as tuples and answers permission checks at scale. Its published design inspired open-source ReBAC engines such as OpenFGA, SpiceDB and Ory Keto.