RBAC, ABAC and resource ownership

Authentication and authorization Mid-level Python 3.13+ PostgreSQL 17+ Reviewed By Best Latest Apps

Pick the fix

An editor in tenant A requests GET /docs/99, which belongs to tenant B. The role check passes. What's missing?

Options
Hint 1 of 1

What links the user to doc 99?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A A tenant or ownership check on the document itself

Correct. Roles say what kind of action; ownership says on which data.

Roles answer what kind of action someone may take. Whether this document is theirs to touch is a property of the data, so each request has to check the tenant or owner on the object itself.

Why not the others?
  • B A stronger password policy. Unrelated.
  • C Rate limiting. Doesn't stop one request.
  • D A new 'tenant-editor' role. Still needs the per-resource check.

30-second answer

Role-based access control assigns permissions to roles (admin, editor, viewer) and roles to users: simple to reason about and audit, but it can't say 'only their own invoices'. Attribute-based control evaluates rules over user, resource and context attributes (department, owner, time). Relationship-based control (as in Google's Zanzibar paper) derives access from links like 'member of team that owns doc'. Most apps combine coarse roles with per-resource ownership checks.

Practise saying it · 35 s. No recording, just a timer

Model access control.

Say your answer out loud, then check which of these points you covered:

  • RBAC: roles
  • ABAC: attribute rules
  • ReBAC: relationships
  • Ownership on every resource
  • Deny by default

Deep dive

Check authorization on every request, in the service that owns the data.

Centralise policy (OPA, Cedar, OpenFGA) when many services share rules.

Deny by default; log denials.

Multi-tenant apps scope every query by tenant id.

Common mistakes

  • Checking only the role and never the resource's owner or tenant.
  • Authorization only in the UI.
  • Hard-coding user ids in permission checks.

Senior take & follow-ups

Define each model, then the practical mix: roles plus ownership, deny by default.

Follow-up questions

Think of your answer first, then open the hint.

  1. Where do ownership checks go?

    Show hint

    In the query or service: WHERE id = $1 AND tenant_id = $2.

  2. What is Zanzibar?

    Show hint

    Google's relationship-based authorization system described in a 2019 paper.

Related questions

Suggest a fix if something here is wrong or out of date.