That's exactly what I was looking for, I'll add it to my notes, thanks!

Hi, this maybe a dumb question but I was wondering if there was some way to hide certain objects. E.g., in the Google groups example, is it possible for only managers to view all members but members to view a subset of those?

(Or is this better addressed by. ABAC?)

you mean if you had a

view_members

permission or..?

Yes. So, would it be possible for a manager to view all the members where a plain member could only view a subset of those, both sets being made visible through the same permission (“view_members”)?

Question about wildcards (may be similar to DaBeast's question): https://play.authzed.com/s/Nb5qaDFMVqTg/assertions So I made a simple schema with users, groups and posts. A post can have readers/writers, which can be groups or users. Reader can also be wildcard user I was thinking: what I wanted a group siteadmins which could write all posts? I would expect to be able to have some relation damproto/post:*#writer@damproto/group:siteadmins but from what I can tell you can't put a \* in the resource id. Would I need to make a tuple per post, or is there a simpler way I am missing

How would you express that as a check?

Add a platform at the top level with a relation representing the super users and add that to all posts

Something like:- relation member:user, relation manager:user, permission view_member = member + manager

sure, but I meant: you said you want to restrict access to all members, so does that mean having

view_member

and

view_other_kind_of_member

permissions, or...

Yes, that is what I am trying to avoid. I am trying to, under the same permission of

view_member

give different lists to a

member

and a

manager

.

do you mean you want

view_member

to be granted to either member or manager, or...?

I want the following test relation:-

user:a#member@group:x
user:b#manager@group:x

With the following expected relation:-

user:b#view_member:

a b

user:a#view_member:

a

so user:b can view member

b

and

a

, but user

a

can only view

a

?

and how is

member

related to a group?

Yes (the opposite, but same idea of reusing the same permission for both cases)

right, but in your expected relations above, you used a resource type of

member

if you mean for the group itself, you'd likely have something like

permission view_member = member + manager

Yes. sorry, I meant

user

not

member

(fixed)

so you're checking

view_member

on the user as the resource?

Ah, I see what you mean. I actually meant as the subject (lookup-resources) but the case still applies.

lookup-resources will show all resources on which a particular user has permission

so if you, say, define a

view_member

permission on a group, you can find all groups that a user can view members

I think I get that, confused things by trying to write expected relations in notation. The main question is - I would want both

a and b

to be viewable with

view_member

by a manager (

b

) but only

a

to be viewable with the same permission

view_member

by a member(

a

)

that's not really a thing though

a permission is a question of the form

does {subject} have  {permission} on {resource}