A relationship tuple is a structured record stating that a subject holds a named relationship to a typed object. In OpenFGA, tuples store facts such as who owns, views, or manages an entity, forming a graph that permission checks traverse. section 8.3.1 section 8.3.2
Read a tuple such as document:doc1#owner@user:alice as:
- document:doc1 identifies the typed object. section 8.3.2
- owner names the relationship being asserted. section 8.3.1
- user:alice identifies the subject connected to that object. section 8.3.2
Delegated document access
Two tuples can establish delegated access: document:doc1#owner@user:alice and user:alice#manager@user:carol. If can_access includes owner->manager, OpenFGA follows those relationships and permits Carol to access the document without changing the policy. section 8.3.2
document:123#viewer@user:alice
Inspect a compact tuple example showing the object, relationship, and subject in OpenFGA notation. section 8.3.1
