Lion Cipher Lab

Fine-grained authorization with OpenFGA: model relationships (ReBAC) when roles stop scaling

• Identity & Access Management
• Advanced
• ~90 min
• Free · no account required

Why it matters

Role-based access control is where every application starts and where a surprising number of them get stuck. Roles work beautifully while the answer to 'may this person do this?' depends only on who the person is. They fall apart the moment the answer depends on the thing being acted upon and its relationships: this document, inside that folder, shared with this one contractor, owned by someone who has since left the workspace, and archived last Tuesday. Product teams hit this wall the week they ship a Share button, and the usual response is to invent a role per resource —…

What you'll learn

• relationship-based access control (ReBAC) and the Google Zanzibar model
• running an OpenFGA authorization server locally in Docker
• driving the fga CLI and the raw OpenFGA HTTP API
• writing an authorization model in the OpenFGA DSL (types, relations, schema 1.1)
• the four operators: union (or), intersection (and), exclusion (but not) and tuple-to-userset (from)
• modelling permission inheritance through a parent folder
• writing relationship tuples and reading a Check result
• using ListObjects for access-aware filtering, and knowing why it is the hard query
• conditions (ABAC-flavoured constraints) and contextual tuples
• choosing between RBAC, ABAC and ReBAC on evidence rather than fashion

Steps in this lab

1. The requirement that breaks roles — read it before you touch a terminal
2. The vocabulary, defined once, so nothing later is a guess
3. Run OpenFGA locally in Docker and prove the API answers
4. Get the fga CLI and create your first store
5. Model v1: types and relations, direct assignment only
6. Write tuples, run your first Checks, and meet the wall
7. `from`: tuple-to-userset, the operator that makes ReBAC ReBAC
8. ListObjects: 'what can Alice see?' — and why it is the hard question
9. `but not`: archive the document and watch an allowed Check flip to denied
10. `and` plus conditions: intersection, and the ABAC flavour done honestly
11. The decision: RBAC vs ABAC vs ReBAC — and when NOT to do any of this
12. The operational bill: a hot path, a latency budget, a cache, and stale permissions
13. The model is the security boundary — test it, review it, then tear it down

Open the full interactive lab →