什么是 ReBAC？ Relationship-Based Access Control with Examples

What is ReBAC?

Relationship-based access control (ReBAC) decides access from relationships between users and resources: alice is the owner of a document, bob is a viewer of it, the document is in a folder, the folder belongs to a team. Rules are written once per type of relationship, for example "owners may edit, viewers may read", and every user gets access through the relationships recorded for them.

ReBAC 回答的典型问题：

• 用户是不是资源的 所有者？
• 用户是不是拥有该资源的项目的 成员？
• 资源是否 属于某种类型，而用户有权访问这种类型？

It fits applications where sharing is part of the product: document and file sharing, collaboration tools, project trackers, social networks and multi-tenant SaaS.

ReBAC and Google Zanzibar

ReBAC became widely known through Google's paper on Zanzibar (USENIX ATC 2019), the system behind sharing in Google Drive, Calendar and other services. Zanzibar stores relationships as tuples of object, relation and user, such as doc:design.md#viewer@user:bob. Open-source services such as OpenFGA and SpiceDB follow the same design. In Casbin the same fact is one policy row, g, bob, design.md, viewer, and the model's matcher says what each relation allows.

ReBAC vs RBAC vs ABAC

	Access comes from	Example rule
RBAC	The user's role, the same for every resource	editors may edit documents
ReBAC	The user's relationship to this particular resource	the owner of a document may edit it
ABAC	Attributes of the user, resource and environment	people in the document's department may read it during business hours

RBAC with a role per resource ("alice is editor of doc1") is already a simple form of ReBAC, which is how Casbin models it below. Choosing an access control model works through one example in every model and compares them side by side.

Casbin 中的 ReBAC

Casbin 这样对 ReBAC 建模：

• 用户 - 资源 - 角色 关系：“用户 U 在资源 O 上拥有角色 R”（例如 alice 是 doc1 的 collaborator）。
• 资源 - 类型 关系：“资源 O 属于类型 T”（例如 doc1 属于类型 doc）。

权限则是“角色 R 可以对类型 T 执行操作 A”；如果用户在某个属于类型 T 的资源上拥有角色 R，就获得该权限。模型示例：

[request_definition]
r = sub, obj, act

[policy_definition]
p = role, obj_type, act

[role_definition]
g = _, _, _
g2 = _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, r.obj, p.role) && g2(r.obj, p.obj_type) && r.act == p.act

# Permission definition: The "collaborator" role can read files of type "doc"
p, collaborator, doc, read

# User-Resource-Role Relationship: alice is a collaborator of doc1
g, alice, doc1, collaborator

# Resource-Type Relationship: doc1 is of type "doc"
g2, doc1, doc

也就是：用户必须拥有正确的 资源上的角色，并且资源必须符合权限规则中的 类型。 Casbin 结合 g（用户 - 资源 - 角色）、g2（资源 - 类型）和 p（角色 - 类型 - 操作）来判定访问。

FAQ

Do I need a Zanzibar-style service to use ReBAC? No. If relationships fit in your application's database and checks happen inside your service, a library such as Casbin is enough. A dedicated service makes sense when many services must share one relationship store; see Casbin vs. OpenFGA.

Can I try this model without writing code? Yes. Choose the ReBAC example in the online editor.