I'm trying to formulate an RBAC permission model which allows separation between permissions and the scopes on which those permissions are applied. I have been unable to find a standard model which describes this.

Here's an example:

  1. A Permission consists of an Operation on a Resource:
    • (View) (Ops Reports)
    • (Create) (Ops Reports)
    • (Manage) (Releases)
  2. Roles are collections of Permissions:
    • A (Product Manager) can (Manage Releases) and (View Ops Reports)
    • A (Ops Manager) can (Create Ops Reports) and (View Ops Reports)
  3. Users can be assigned Roles:

    (Alice) and (Bob) are (Product Manager)s

So far, this is standard RBAC-0. Now let's add another orthogonal layer:

  • (Alice) is a (Product Manager) for "Cool New Product (CNP)"
  • (Bob) is a (Product Manager) for "Flagship Product (FSP)"
  • (Charlie) is a (Product Manager) for ...
  • ...

This seems like a fairly common use case.

In a naive implementation, we could duplicate Roles and Permissions for every Product. So instead of:

  • (Product Manager)
    • (Manage) (Releases)
    • (View) (Ops Reports)

we now have:

  • (CNP Product Manager)
    • (Manage) (CNP Releases)
    • (View) (CNP Ops Reports)
  • (FSP Product Manager)
    • (Manage) (FSP Releases)
    • (View) (FSP Ops Reports)
  • ...
  • ...

This can quickly grow out of hand. How do I model this scenario to avoid exponential duplication?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.