Relationship-based access control
Relationship-based access control is an authorization technique that makes decisions from defined relationships among principals, resources, groups, and other entities.
Authorization in Action
A relationship permission is an access rule or authorization pattern in which permission depends on an authorization-relevant relationship between entities.
- How it is used
- Supports fine-grained sharing, ownership, delegation, and collaboration access in relationship-rich applications.
- How deep it goes
- Explains graph-based evaluation, static rules, relationship updates, architecture mapping, and operational limitations without formal graph algorithms.
- Examples
- Uses shared documents, support tickets, deployment plans, customer workspaces, ownership, editing, and manager inheritance.
- What you can do after
- Apply it by modeling relations, defining permitted paths, and governing relationship changes in collaborative systems.
Read how Authorization in Action explains relationship-based access control →
Software Security for Developers
Relationship-based access control, or ReBAC, is an access-control technique that makes authorization decisions from relationships among entities such as users, resources, groups, and projects.
- How it is used
- Uses connections among users, groups, projects, and resources to make fine-grained authorization decisions.
- How deep it goes
- Explains entities, relationships, use cases, deployment patterns, and tradeoffs, but stops short of full policy implementation.
- Examples
- Uses shared documents, team ownership, project access, organizational hierarchies, delegation, and central relationship-store queries.
- What you can do after
- Evaluate whether relationship-driven authorization fits collaborative, multitenant, hierarchical, or delegated access patterns.
Read how Software Security for Developers explains relationship-based access control →
Related concepts
- attribute-based access controlcontrasts with · Attribute-based access control is an authorization model that evaluates subject, resource, action, and contextual attributes against policies to make access decisions.
- OpenFGAimplemented by · OpenFGA is an open-source authorization service that models and evaluates fine-grained, relationship-based permissions among users and resources.
- graphuses · A graph is a mathematical structure consisting of vertices connected by edges that represent relationships or connections.
- authorization modelkind of · An authorization model is a formal scheme that represents authority and determines whether subjects may perform actions on resources.
- role-based access controlcontrasts with · Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.