Modeling discretionary authority?

[jsshapiro]

We have an application where it would be nice to be able to turn off some authority on a discretionary basis. It doesn't change any of the security requirements or considerations, but it helps to avoid "fat fingering" a system by mistake.

It seems to me that this can involve a very large number of relation updates as the discretionary authority is turned on and off.

Anybody hvae thoughts on how best to model this sort of thing?

[josephschorr]

@jsshapiro how granular do you need the authority to be? If it is a role-level or even higher, you can do so using a relationship from the object to itself, but I'll need more insight to show examples

[jsshapiro]

It is exactly role level, but a role might have a pretty large number of granular authorities. Compartmented permissions is a reasonable placeholder picture, or alternatively someone who is an employee with additional authority captured by a role that they generally don't want to use by mistake. The underlying assumption here being that the roles in question are additive rather than disjoint.

I suppose I actually have two questions. The first is how to model it, but the second is whether, having modeled it, one ends up with a functional system. It seems to me that this sort of on/off switch moves a whole bunch of permission tuples into and out of the active set all at once. If the specification has a lot of compound relationships, I would think that could get pretty expensive to update.

That said, it appears to me that this kind of thing happens, architecturally speaking, very close to the session - it doesn't make a lot of sense to enable this kind of selectivity deep in the relation graph. I'm thinking more along the lines of a solution where the authority of a session is the union of its active session roles. And since that definitely wants to be per-session, I'm thinking about a system in which those roles are cloned or joined (in the sense of becoming a member) on a per-session basis.

But I don't underatand the practical implementation of the Zanzibar model to understand just how big or how difficult the resulting graph updates are.

Before I forget, thanks for any understanding you are able to share!

[josephschorr]

@jsshapiro This might be easier to answer in our Discord, if you prefer. Otherwise, I can write it out here.

[jsshapiro]

Haven't been on discord in years.

[jsshapiro]

OK. Up on discord now in #spicedb. Look for the discretionary roles thread