Fine-grained Access Control: Concepts and Best Practices - Aserto
Fine-grained Authorization eBook
This ebook covers the evolution of fine-grained access controls, popular authorization models and example policies, as well as resources to help add fine-grained authorization to your applications.
- What fine-grained access control is and best practices
- When to use RBAC
- When to use ABAC
- When to use ReBAC
- How to combine models
Fine-grained, real-time access control made easy
Support RBAC, ABAC, and ReBAC out of the box. Enforce in millisecond latency and high availability.
allowed {
ns := time.now_ns()
day := time.weekday(ns)
day == data.workdays[_]
}
Include environmental attributes in your policies
allowed {
input.user.properties.dept == "Sales"
}
Use any user-centric attributes in your policies
allowed {
ds.check({
"subject_type": "user",
"subject_id": input.user.id,
"relation": "manager",
"object_type": "user",
"object_id": input.resource.id
})
}
Make access decisions based on org-chart relationships
allowed {
ds.check({
"subject_type": "user",
"subject_id": input.user.id,
"relation": "can_read",
"object_type": "document",
"object_id": input.resource.id
})
}
Model your resource hierarchy and enforce fine-grained authorization
allowed {
ns := time.now_ns()
day := time.weekday(ns)
day == data.workdays[_]
}
Include environmental attributes in your policies
allowed {
input.user.properties.dept == "Sales"
}
Use any user-centric attributes in your policies
Make access decisions based on org-chart relationships
Model your resource hierarchy and enforce fine-grained authorization
allowed {
ns := time.now_ns()
day := time.weekday(ns)
day == data.workdays[_]
}
Include environmental attributes in your policies
- 1
- 2
- 3
- 4
The best of OPA and Zanzibar
Topaz is an open-source authorization system that allows you to combine RBAC, ABAC, and ReBAC as you see fit.
Centralized authorization system
Aserto is a unified access control system for your applications, services, and APIs