> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fga.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Conditions

> Modeling relationships with Conditions

## Overview

Conditions allow you to model more complex authorization modeling scenarios involving attributes and can be used to represent some Attribute-based Access Control (ABAC) policies. Take a look at the [Conditions](https://docs.fga.dev/fga-concepts.md#what-is-a-condition) and [Conditional Relationship Tuples](https://docs.fga.dev/fga-concepts.md#what-is-a-conditional-relationship-tuple) concepts for a quick overview.

There are various use cases where Conditions can be helpful. These include, but are not limited to:

* [**Temporal Access Policies**](https://github.com/openfga/sample-stores/tree/main/stores/temporal-access) - manage user access for a window of time.
* [**IP Allowlists or Geo-fencing Policies**](https://github.com/openfga/sample-stores/tree/main/stores/ip-based-access) - limit or grant access based on an IP Address range or corporate network policy.
* [**Usage-based/Feature-based Policies (Entitlements)**](https://github.com/openfga/sample-stores/tree/main/stores/advanced-entitlements) - enforce quota or usage of some resource or feature.
* [**Resource-attribute Policies**](https://github.com/openfga/sample-stores/tree/main/stores/groups-resource-attributes) - define policies to access resources based on attributes/fields of the resource(s).

## Defining conditions in models

For this example we'll use the following authorization model to demonstrate a temporal based access policy. Namely, a user can view a document if and only if they have been granted the viewer relationship AND their non-expired grant policy is met.

FGA model · DSL

> [!NOTE]
>
> The type restriction for `document#viewer` requires that any user of type `user` that is written in the relationship tuple must be accompanied by the `non_expired_grant` condition. This is denoted by the `user with non_expired_grant` specification.

Write the model to the FGA store:

## Writing conditional relationship tuples

Using the model above, when we [Write](https://docs.fga.dev/api/service/relationship-tuples/write.md) relationship tuples to the Auth0 FGA store, then any `document#viewer` relationship with `user` objects must be accompanied by the condition `non_expired_grant` because the type restriction requires it.

For example, we can give `user:anne` viewer access to `document:1` for 10 minutes by writing the following relationship tuple:

## Queries with condition context

Now that we have written a [Conditional Relationship Tuple](https://docs.fga.dev/fga-concepts.md#what-is-a-conditional-relationship-tuple), we can query OpenFGA using the [Check API](https://docs.fga.dev/api/service/relationship-queries/check.md) to see if `user:anne` has viewer access to `document:1` under certain conditions/context. That is, `user:anne` should only have access if the current timestamp is less than the grant timestamp (e.g. the time which the tuple was written) plus the duration of the grant (10 minutes). If the current timestamp is less than, then you'll get a permissive decision. For example,

but if the current time is outside the grant window then you get a deny decision. For example,

Similarly, we can use the [ListObjects API](https://docs.fga.dev/api/service/relationship-queries/list-objects.md) to return all of the documents that `user:anne` has viewer access to, given the current time. For example,

but if the current time is outside the grant window then we don't get the object in the response. For example,

> [!NOTE]
>
> When evaluating a condition at request time, the context written/persisted in the relationship tuple and the context provided at request time are merged together into a single evaluation context.
>
> If you provide a context value in the request context that is also written/persisted in the relationship tuple, then the context values written in the relationship tuple take precedence. That is, the merge strategy is such that persisted context has higher precedence than request context.

## Examples

For more examples take a look at our [Sample Stores](https://github.com/openfga/sample-stores) repository. There are various examples with ABAC models in that repository.

## Supported parameter types

The following table enumerates the list of supported parameter types. The more formal list is defined in [https://github.com/openfga/openfga/tree/main/internal/condition/types](https://github.com/openfga/openfga/tree/main/internal/condition/types).

Note that some of the types support generics, these types are indicated with `<T>`.

| Friendly Type Name | Type Name (Protobuf Enum) | Description | Examples |
| - | - | - | - |
| int | TYPE\_NAME\_INT | A 64-bit signed integer value. | -1 "-1" |
| uint | TYPE\_NAME\_UINT | A 64-bit unsigned integer value. | 1 "1" |
| double | TYPE\_NAME\_DOUBLE | A double-width floating point value, represented equivalently as a Go `float64` value. If the value is provided as a string we parse it with `strconv.ParseFloat(s, 64)`. See [`strconv.ParseFloat`](https://pkg.go.dev/strconv#ParseFloat) for more info. | 3.14159 -0.75 "1" "-2.5" |
| bool | TYPE\_NAME\_BOOL | A boolean value. | true false "true" "false" |
| bytes | TYPE\_NAME\_BYTES | An array of byte values specified as a byte string. | "bytestring" |
| string | TYPE\_NAME\_STRING | A string value. | "hello, world" |
| duration | TYPE\_NAME\_DURATION | A value representing a duration of time specified using Go duration string format. See [time.Duration#ParseDuration](https://pkg.go.dev/time#ParseDuration) | "120s" "2m" |
| timestamp | TYPE\_NAME\_TIMESTAMP | A timestamp value that follows the RFC3339 specification. | "2023-01-01T00:00:00Z" |
| any | TYPE\_NAME\_ANY | A variant type which permits any value to be provided. | \{"x": 1} "hello" \["a", "b"] |
| list\<T> | TYPE\_NAME\_LIST | A list of values of generic type T. | list\<string> - \["a", "b", "c"] list\<int> - \[-1, 1] list\<duration> - \["60s", "1m"] |
| map\<T> | TYPE\_NAME\_MAP | A map whose keys are strings and whose values are values of generic type T. Any map value must have string keys, only the value types can vary. | map\<int> - \{"x": -1, "y": 1} map\<string> - \{"key": "value"} |
| ipaddress | TYPE\_NAME\_IPADDRESS | A custom value type specified as a string representation of an IP Address. | "192.168.0.1" |

## Limitations

The size of the condition `context` parameter that can be written alongside a relationship tuple is limited to 32 KB. For information about Google CEL expressions, see the [Language Definition for Google CEL](https://github.com/google/cel-spec/blob/master/doc/langdef.md).