Glossary

ReBAC

Relationship-based access control

Access follows relationships between subjects and objects, such as owner of a document or member of a group that can view a folder, stored as a graph and checked by query; Google’s Zanzibar paper (2019) popularized it, and OpenFGA and SpiceDB implement it.

Defined in: Pang et al., Zanzibar: Google’s Consistent, Global Authorization System (USENIX ATC 2019)

Covered in

Guide

Authorization models: RBAC, ABAC, ReBAC and policy as code you can test

Translate roles, attributes and relationships into explicit subject-action-resource decisions, prevent broken object level authorization (BOLA), and verify ownership and tenant boundaries with tests.

Practice: Local project: Secure a real HTTP API