Intermediate LevelAuthentication & Authorization
How does Hierarchical RBAC implement role inheritance across permission trees?
❓ Interview Prompt: Explain Flat RBAC vs Hierarchical RBAC, role inheritance trees, permission resolution, and policy optimization.
In Flat RBAC, roles are independent lists of permissions. As an application grows, managing duplicated permissions across roles (e.g. 'Viewer', 'Editor', 'Admin', 'SuperAdmin') creates administrative burden. Hierarchical RBAC solves this via Role Inheritance.
Role Inheritance Structure:
•
'Viewer': Holds 'posts:read'.
•
'Editor' (inherits 'Viewer'): Automatically gets 'posts:read' + adds 'posts:write'.
•
'Admin' (inherits 'Editor'): Automatically gets 'posts:read' + 'posts:write' + adds 'users:delete'.
Permission Resolution:
Resolving permissions recursively traverses the role hierarchy parent-to-child links until matching the target permission.
Code Implementation Example
typescript
// Role Inheritance Tree Definition
const ROLE_HIERARCHY: Record<string, string[]> = {
super_admin: ['admin'],
admin: ['editor'],
editor: ['viewer'],
viewer: []
};
const ROLE_DIRECT_PERMISSIONS: Record<string, string[]> = {
viewer: ['posts:read'],
editor: ['posts:write'],
admin: ['users:delete'],
super_admin: ['system:configure']
};
function getEffectivePermissions(role: string): string[] {
const direct = ROLE_DIRECT_PERMISSIONS[role] || [];
const inheritedRoles = ROLE_HIERARCHY[role] || [];
const inherited = inheritedRoles.flatMap(getEffectivePermissions);
return [...new Set([...direct, ...inherited])]; // Merge unique permissions
}💡Recursive permission resolution for Hierarchical RBAC role trees.
🎯 Interview Key Takeaway
Hierarchical RBAC allows child roles to inherit parent permissions, eliminating permission duplication across role definitions.
#Hierarchical RBAC#RBAC#Inheritance#Permissions#Intermediate
Back to all Authentication & Authorization Questions→