Hi, are there any thoughts on my schema posted on October 26? We are currently also discussing whether the module access (endpoints basically, but also backend lambdas) should rather be handled outside AuthZed, via access tokens. This seems to be the standard way to do it, but I see also advantages in keeping everything concerning authorization in AuthZed.

Hey to add on a bit on this use case. The question we want the authz system to answer is "Does user X have permission Y on resource Z?" In this system a role defines a set of permissions. A user can then be bound a role on a resource. Permissions, roles and resource are not known beforehand by the authz system. We want these to be fed to the authz dynamically and not have to update the schema anytime a new permission/role is added. I'm having a hard time modeling this dynamic permission resolution in spicedb. My attempt is available on this playground https://play.authzed.com/s/FaqdSzB7NtZ2/schema but as you can see in the assertions that I cannot answer the original question in a single assertion "Does user X have permission Y on resource Z?" In the linked playground what I would like to assert is that for a given resource both the user and the permission relationship exists. Would really appreciate any input if what I'm trying to achieve is possible and/or if I need to re-think the model.

since you're checking the permission itself dynamically too, you need to create a resource type that references both the resource and permission as a single unit, so you can check it

looking at the WatchService - does it provide a guarantee of ordering (i.e. if we wanted to create an audit log from it), or does it just provide a complete set of events that have happened?

Hi, in your documentation you have this:

I have an authorization service in my firm that adds an additional dimension to the question. We have users, resources, actions and a fourth one called "environment" (env for short)

The question we ask is: What user has insert action on the oracle database resource in the QA environment ?

From what I read about Spice DB and Authzed, this doesn't seem to be supported right?

there are two solutions to this: 1) define a new resource type that is the specific resource, in the specific environment, and check that resource (this is recommended today) 2) use our upcoming caveats feature to filter on this additional dimension

I thought about option 1.....ok, I'll try to model that Also, I come from a very traditional IAM background dealing with policy files and policy decision points. Is it safe to say here that the schema in spicedb is essentially the policy file?

its similar

Our policies are written in a logical programming language (Prolog). While it is hard to program in Prolog, it does give us some very cool out of the box features. It allows us to query it and ask questions like: "Given a user (eg. Jake), give me all the action and resource pairs" "Given a specific action (in your case a permission) and a resource, tell me all the users that have this"

But prolog is a PITA, and that's why I'm researching on alternatives to our stone age solution

Can SpiceDB answer questions like the above?

you can do the latter with LookupSubjects

the former can be done with LookupResources, although only for a specific permission at a time

if you have roles, you can use ReadRelationships to get all the roles too

i see

Roles are known as "relationships" in spicedb lexicon right?

sorry, i mean "relations"

wow you know your spicedb really well man. Are you an employee of Authzed?

I'm the CTO 🙂

LOL

and yes, you can use a

relation

as a role, in an RBAC-style schema

Can this solution be installed on prem ?

yep!

you can either run SpiceDB yourself, or we have an enterprise version that provides management and support

good to know

we also have a dedicated solution if you don't want to run it at all