4 ms·
Since the team seems to be hanging out in the comments: it appears the article was written out of order and "ReBAC" was used without the parenthetical definitio
by mdaniel 3y ago
Since the team seems to be hanging out in the comments: it appears the article was written out of order and "ReBAC" was used without the parenthetical definition in the OPA part but only defined down in the "Advantages of Google Zanzibar" section. I did what I usually do on an unusual acronym and "right-click, search" but .. that went poorly. The actual definition of "Relationship-based Access Control (ReBAC)" did show up about 4 results in, so fine, but it would be cheaper for the reader if you were to pull that upward to "define on first use"
I would pay $1 if it was clarified about how that differs from RBAC or ABAC but maybe I just haven't gone through enough blogs to already know
- orweis 3y agoHi! Fair point. We got two articles coming this month: RBAC vs ReBAC, and RBAC vs ReBAC vs ABAC - we'll post those here / in the article itself when ready. For now, in short: RBAC (Role based) is a simple identity to role to permission mapping. ABAC (Attribute based) maps conditions on attributes to to permissions (technically can implement anything - mostly used for things like time based, quotas, location, etc.) ReBAC (relationship based) maps relations between identities and resources to permissions (e.g. if a user is related as an owner to a folder, and the folder contains a file, the user is the owner of the file) - commonly used for resource and organization hierarchies