Authorization models and enforcement
A role can start the question; the protected object, relationship and context finish it.
Predict first
Before you read: predict
Mira is a north-tenant result analyst assigned to the north result. The south result is in the south tenant and assigned to Omar. Lee is a north-tenant proctor, not a result analyst. A result-read policy evaluates result-analyst role, fetched-result tenant, and analyst assignment. It receives, in order: Mira → north result, Mira → south result, Lee → north result.
What response triple does it return?
The 30-second version
Authentication says who presented a credential; authorization decides whether an actor may perform an action on an object now. RBAC maps roles to permissions. ABAC evaluates subject, object and environment attributes. ReBAC evaluates a stored relationship, such as a proctor assigned to a session. One broad role rarely supplies every fact a record decision needs.
A role can start the question; the protected object, relationship and context finish it.
How it works
Step 1 of 8
Analogy: Community greenhouse tending permissions
A coordinator has a broad duty. A grower needs the plot assignment and current season checked; a label hidden on a clipboard cannot open the gate.
| Greenhouse fact | Results-policy input |
|---|---|
| coordinator duty | RBAC role |
| season and temperature record | ABAC attributes |
| roster entry: grower tends plot 12 | ReBAC relationship |
| gatekeeper reads roster | trusted server decision |
Breaks down when: a role is enough for a whole resource type. A relationship is data that can change, so its source and update path need separate controls.
Examples, run for real
4.1 Results-service decision lifecycle (policy-server.mjs)
EXH-1910 recorded a result analyst role check that omitted the fetched result tenant and analyst-assignment attributes. MR !2110 moves the complete decision to the result service. In the local fixture, the server resolves the requested synthetic result, passes trusted actor and result fields to a Casbin matcher, and serializes a result only when the matcher allows it.
This order matters. A route, button state, request-supplied tenant or stale cached object may help construct a request, but none is permission for the requested record. The service needs an explicit decision for the actor, action and fetched object. A denial is a safe response shape: it carries no protected result fields. OWASP
example nora->west=403/- · body=forbidden4.2 Policy inputs are independent (policy-server.mjs)
The fixture keeps the role, tenant, analyst assignment, proctor-to-session relationship, candidate ownership and exam-window state as separate fields. That makes a diagnosis possible: changing only one field tells us which condition was missing. RBAC supplies the broad duty; ABAC adds subject, object and environment scope; ReBAC links a person to a particular session. A production service must also define where those trusted fields originate and how relationship changes are synchronized. Casbin model syntax
The policy shape should follow the question the service is answering. A broad analyst role can be the right input for a report listing that has already been reduced to authorized records, but it is insufficient for a direct record read when the result belongs to a particular tenant and analyst queue. Likewise, a proctor role may establish the job function while the relationship identifies the session for that function. The environment condition is separate again: a closed window changes a decision without rewriting roles or relationship data. Keeping these facts distinct makes reviews and audit traces legible, and keeps a future change to one fact from silently granting another.
4.3 Enforcement placement
OWASP's authorization guidance supplies the boundary evidence used by the cited practice item: permission is evaluated at the server for the specific object on every request. OWASP
Try it
Answer first, then check. Nothing is saved.
Question 1 of 6
Mira is a north-tenant result analyst. North is assigned to Mira; south-Mira is in the south tenant but also assigned to Mira. Ivy is a north-tenant result analyst and is not assigned to north. A matcher evaluates analyst role, fetched-result tenant and assignment. It receives: Mira → north, Mira → south-Mira, then Ivy → north.
What response triple does it return?
Question 2 of 6
Lee is a north-tenant proctor listed for session 88. Result north belongs to session 88 and is owned by candidate N; result north-99 belongs to session 99. Candidate N is a north-tenant candidate, owns north, and is not a listed proctor. A matcher evaluates a proctor's stored session relationship. The requests are Lee → session 88, Lee → session 99, then candidate N → session 88.
What response triple does it return?
Question 3 of 6
Candidate N and candidate peer are in the north tenant. North is owned by candidate N; north-peer is owned by candidate peer. The candidate policy evaluates candidate role, tenant, result owner and requested action. Candidate N reads north, reads north-peer, then writes north.
What response triple does it return?
Question 4 of 6
A catalog screen hides a Download button after a route role check. A signed-in seller then requests a different invoice id.
Which server placement should decide this response?
Question 5 of 6
The audit records four reads: Lee is a proctor listed for session 88; north is session 88 and open; closed-88 is session 88 and closed; north-99 is session 99 and open; candidate N owns north but is not a proctor. The observed responses are Lee → north 200, Lee → closed-88 403, Lee → north-99 403, candidate N → north 403.
Which predicate set accounts for all four rows?
Question 6 of 6
Mira is a north-tenant analyst assigned to north and unassigned to south. Omar is a south-tenant analyst assigned to south and unassigned to north. Each first requests north, then requests south; both callers send tenant=south on that second request. The observations below show that second response.
Which implementation keeps each decision and returned record together?
Go deeper
Pro tip
Write a negative authorization test beside every allowed case: same role plus a different object, tenant or relationship must receive a refusal. This follows OWASP's object-specific, per-request guidance. OWASP
Source
- OWASP, Authorization Cheat Sheet, fetched 2026-09-30. It defines RBAC, ABAC and ReBAC, recommends default deny, specific-object checks on every request, and server-side enforcement.
- NIST, SP 800-162: Guide to Attribute Based Access Control, fetched 2026-09-30. It defines ABAC decisions over subject, object, environment attributes and policy.
- Pang et al., Zanzibar, fetched 2026-09-30. It is the curriculum-listed relationship-authorization source; this lesson makes no Zanzibar-scale claim.
- Casbin, Syntax for models, fetched 2026-09-30. It documents the local policy library's request, policy, role and matcher sections.
Related lessons
Checked against the tools and docs as of 2026-09-30.