3 ms·
Looks neat, one of the places I've seen open source systems like this trip on is when you need to know: what principals can do a certain thing Went through a b
by NegativeLatency 3y ago
Looks neat, one of the places I've seen open source systems like this trip on is when you need to know: what principals can do a certain thing
Went through a big Ory Keto implementation to get stuck on not being able to do this last crucial bit, so we ended up implementing our own role based access control
- mooreds 3y ago> what principals can do a certain thing Hmmm. What's an example of this?
- SgtBastard 3y agoPolicy: Transactions under $X can be raised and approved by the same person. >X requires an independent approver with permission “supervisor”. Activity: Alice (a supervisor), raises a transaction >X, Bob is a supervisor, Eve is not. Problem: “Who can approve the transaction?” (As humans the answer is obviously Bob, but for typical implementation approaches to AuthZ policy, this is challenging to determine. Typically it’s done out of band and then makes a decision when requested by Bob (allow) or Eve (deny))
- mooreds 3y agoAwesome, thanks. So it's almost like there's a rules engine needed, because "independent" plays a role.