Intermediate LevelAuthentication & Authorization
What is Relationship-Based Access Control (ReBAC) and the Google Zanzibar model?
❓ Interview Prompt: Explain Relationship-Based Access Control (ReBAC), relationship tuple stores, graph traversals, and Google Zanzibar principles.
Traditional RBAC and ABAC struggle with deeply nested collaborative permissions (e.g. Google Drive: "Allow edit if user is a member of Team X, which owns Folder Y, which contains Document Z"). Relationship-Based Access Control (ReBAC) models authorization as a graph.
Core Concepts (Google Zanzibar Model):
1
Relation Tuples: Represents relationships as discrete tuples:
$$\langle \text{object} \rangle \# \langle \text{relation} \rangle @ \langle \text{subject} \rangle$$
•
Example: 'doc:file_101#viewer@user:alice'
•
Example: 'folder:tech#owner@group:engineering#member'
2
Graph Evaluation: Checks authorization by traversing relationship graph paths dynamically.
Code Implementation Example
typescript
// OpenFGA / ReBAC relation tuple structure
interface RelationTuple {
user: string; // "user:alice" or "group:engineering#member"
relation: string; // "viewer" | "editor" | "owner"
object: string; // "doc:file_101"
}
// Checking graph relationship: Does Alice have viewer relation on doc:file_101?
const isAllowed = await fgaClient.check({
user: "user:alice",
relation: "viewer",
object: "doc:file_101"
});💡Checking relationship tuple graph authorization in OpenFGA ReBAC.
🎯 Interview Key Takeaway
ReBAC models permissions as relationship tuple graphs, enabling complex nested collaboration access checks.
#ReBAC#Zanzibar#OpenFGA#Authorization#Intermediate
Back to all Authentication & Authorization Questions→