Skip to main content

Model Ownership

Set up resource ownership in Permit.io, so that users can act on the resources they own. This guide is for developers who need an ownership rule and want to choose between attribute-based access control (ABAC) and relationship-based access control (ReBAC).

Both approaches implement this example:

Example

Bob, a user in your application, can read, update, and delete the files he owns.

Choose an approach​

ApproachHow ownership is storedStrengthsLimitations
ABACAn owner attribute on each resourcePer-resource control, with no relationship data to syncCan't follow application relationships, such as a file inside a folder. You set the owner on every resource.
ReBACAn owner role on a parent resource, derived to its childrenOwnership follows your resource hierarchyMore parts to model: relations, resource roles, role derivations, and instance relationships
Ownership with roles

You can also model ownership with role-based access control (RBAC) roles. Roles don't refer to a specific resource, so you would need a separate role for each user and each resource. This approach doesn't scale beyond a few resources.

Prerequisites​

  • A Permit.io account with a project and an environment. See the Quickstart.
  • A resource called File. For the ReBAC approach, also a resource called Folder. See Policy basics.
  • For the ABAC approach, a role called User, assigned to the user Bob on the Directory screen.
  • To verify with a check: a Permit SDK connected to a policy decision point (PDP). See Check permissions with permit.check().

ABAC​

ABAC decides access based on attributes of users and resources. For ownership, each file has an owner attribute. A resource set matches the files whose owner equals the key of the user who makes the request, and you grant that resource set its actions.

Example

Diagram of the user Bob connected to the Bob's Files folder and to File1, File2, and File3, each with the attribute Owner: Bob, and the conditions User.id == File.owner and User.id == Folder.owner

Set up ABAC ownership in Permit​

  1. Sign in to the Permit dashboard.
  2. Open Policy and select the Resources tab. Find the File resource and click Add Attributes. Resources tab with the File resource and the Add Attributes link
  3. In the resource editor, under ABAC Options, click Add attribute. Resource editor with the ABAC Options section
  4. Name the attribute owner, set its type to String, and click Save. ABAC Options with the owner attribute of type String
  5. Select the ABAC Rules tab and create a resource set:
    • Name: file ownership (key file_ownership)
    • Resource type: File
    • Condition: resource.owner equals (ref) user.key Resource Set form named file ownership for the File resource type, with the condition resource.owner equals (ref) user.key
  6. Select the Policy Editor tab. Under the User role, select read, update, and delete for the file ownership resource set, and save. Policy Editor with the file ownership resource set

The resource set matches a file when its owner attribute equals the user.key of the user who makes the request.

Verify ABAC ownership​

Call permit.check() for Bob on a file, and pass the owner attribute:

  • permit.check("Bob", "update", { type: "File", attributes: { owner: "Bob" } }) returns true.
  • The same check with owner: "Alice" returns false.

ReBAC​

ReBAC decides access based on relationships between resource instances. For ownership, a user who owns a folder also owns every file in the folder, through a parent-child relationship between the folder and its files.

Example

Graph of Bob as Owner of the Bob's Files folder, which is the Parent of the Bob's Pics and Bob's Docs folders, each of which is the Parent of files

The ReBAC policy for this graph is:

A user who is assigned the role Folder#Owner is also assigned the role File#Owner when the Folder instance is the Parent of a File instance.

If a file is in a folder (a parent-child relationship), and a user owns the folder, the user also owns the files in the folder.

Set up ReBAC ownership in Permit​

  1. Sign in to the Permit dashboard.
  2. Open Policy and select the Resources tab. Click Add Roles on a resource. Resources tab with the Add Roles and Add Attributes links for the File resource
  3. Under ReBAC Options, add a resource role named owner to both the File and Folder resources. In the Folder resource, add the relation folder is parent of file. ReBAC Options of the folder resource with the folder#owner role and the relation folder is parent of file
  4. Define a role derivation: folder#owner derives file#owner when the folder is the parent of the file. See Define role derivations.
  5. Select the Policy Editor tab. Select create, delete, read, and update for file#owner on file, and for folder#owner on folder. Policy Editor with all file actions selected for file#owner and all folder actions selected for folder#owner
  6. Open the Directory screen, select the Instances tab, and create a folder instance with the key Bobs_Files.
  7. On the Directory screen, click Add user. Create the user Bob, and under Assigned Resource Roles, assign folder : Bobs_Files # owner. Create a new user form for Bob with the resource role folder Bobs_Files owner
  8. On the Instances tab, create a file instance, such as bobs_picture. Under Relationships, add folder Bobs_Files is parent of file bobs_picture. New Resource Instance form for the file bobs_picture with the relationship folder Bobs_Files is parent of file bobs_picture

Because the Bobs_Files folder is the parent of the bobs_picture file, Bob's folder#owner role on the folder derives the file#owner role on the file. The permissions of file#owner apply to every file you add to the folder.

Verify ReBAC ownership​

  • permit.check("Bob", "update", "file:bobs_picture") returns true, through the derived file#owner role.
  • For a file instance without a relationship to Bobs_Files, the same check returns false.

Next steps​

Contents

Edit this page

Need help?