There are possible use cases where a group of users have a certain role on or permission to an object. For example, members of a certain team could have an editor relation to a certain document.To represent this in Auth0 FGA:
Introduce the concept of a team to the authorization model. →
01. Introduce the concept of a team to the authorization model
First, define the objectteam in your authorization model. In this use case, a team can have members, so you make the following changes to the authorization model:
03. Assign the team members a relation to an object
To represent groups, use the type:object_id#relation format, which represents the set of users related to the type:object_id as a certain relation. For example, team:writers#members represents the set of users related to the team:writers object as members.In order to assign members of a team a relation to a document, create the following relationship tuple stating that members of team:writers are editors of document:meeting_notes.doc.
04. Check an individual member’s access to an object
Now that you have:
a relationship tuple indicating that alice is a member of team:writers
a relationship tuple indicating that members of team:writers are editors of document:meeting_notes.doc
The *check\ is alice an editor of document:meeting_notes.doc returns the following:The chain of resolution is:
alice is member of team:writers
members of team:writers are editors of document:meeting_notes
therefore, alice is editor of document:meeting_notes
Note: When creating relationship tuples for Auth0 FGA, use unique ids for each object and user in your application domain. This example uses first names and simple ids as a suggested example.
