Skip to main content
In this guide we are going to model system that requires multiple authorizations before allowing users to perform actions on particular objects using Auth0 FGA. For example, users are allowed to delete a document if both of these conditions are met:
  • they are a member of the organization that owns the document
  • they have writer permissions on the document
In this way, we prevent other users from deleting such document.

​
Before You Start

In order to understand this guide correctly you must be familiar with some Auth0 FGA Concepts and know how to develop the things that we will list below.

​
Step By Step

With the above authorization model and relationship tuples, Auth0 Fine-Grained Authorization (FGA) will correctly respond with {"allowed":true} when *check*is called to see if Carl and Becky can write this document. We can verify that by issuing two check requests: What we would like to do is offer a way so that a document can be written by Becky and Carl, but only writers who are also members of the organization that owns the document can remove it. To do this, we need to:
  1. Add can_delete relation to only allow writers that are members of the ownership organization
  2. Verify that our solutions work

​
01. Add can_delete Relation To Only Allow Writers That Are Members Of The Ownership Organization

The first step is to add the relation definition for can_delete so that it requires users to be both writer and member of the owner. This is accomplished via the keyword and.

​
02. Verify That Our Solutions Work

To verify that our solutions work, we need to check that Becky can delete the planning document because she is a writer AND she is a member of organization:ABC that owns the planning document. However, Carl cannot delete the planning document because although he is a writer, Carl is not a member of organization:ABC that owns the planning document.
Check the following sections for more on how to model privileged access.