An edge is a connection in a relationship graph that records a fact between entities. In authorization, an edge can express ownership, membership, collaboration, or another named relationship between a principal, team, document, or other resource. section 9.4 section 8.3.1
Edges make access decisions depend on who is connected to what and how, rather than only on a static role or access-control list (ACL). A relationship-based access control (ReBAC) check can ask whether a principal has a required relation to a resource, including an indirect relation such as manager of an owner. section 6.1 section 5.3
Model edges as durable policy data:
- Represent group membership as an edge such as principal→memberOf→team, rather than embedding a large principal set in a team entity. section 9.4
- Represent resource facts such as Document→owner→Employee so policies can evaluate ownership and management paths from current entity data. section 9.4 section 7.4.2
- Update edges when authoritative HRIS or CRM data changes, allowing access to change without editing otherwise static policies. section 9.4
- Use a schema to define valid entity types and relations, then store each relationship as a tuple for graph-based permission checks. section 8.3.1
A document viewer edge
The tuple document:123#viewer@user:alice records that Alice is a viewer of Document 123. When asked whether Alice can view that document, a relationship-based engine evaluates the graph and its schema rules instead of relying on imperative application logic. section 8.3.1
Edges support fine-grained collaboration where each document can have different owners, editors, viewers, and inherited folder relationships. They are especially useful when permissions follow organizational, social, or customer-resource connections that change at runtime. section 1.4.2 section 6.1
Figure 9.1 A portion of the relationship graph that makes up the entity store for ACME’s Customer Collaboration Platform
Inspect the graph view to see employees, customers, teams, and documents as nodes, with membership and ownership edges supplying authorization data. section 9.4
