Relationship-Based Access Control
Relationship-Based Access Control, or ReBAC, is an authorization model that makes decisions based on the relationships between subjects, resources, and other entities.
- Acronym
- ReBAC
- Synonym
- ReBAC
Definition
Relationship-Based Access Control, or ReBAC, is an authorization approach in which access is determined by graph-like relationships such as owner of, manager of, member of, approver for, delegated by, editor of, or parent of. Instead of relying mainly on roles or attributes, ReBAC focuses on how entities are connected. This model is especially useful in collaboration systems, content platforms, healthcare, B2B sharing, delegated administration, and multi-tenant environments where access depends on resource ownership, hierarchy, or business relationships. ReBAC often provides a more natural expression of object-level permissions and delegated access patterns than traditional RBAC.
Why it matters
ReBAC is highly relevant for modern applications where authorization depends on who is related to what, not only on organizational role.
The Ariovis perspective
Roles are useful when they reflect stable business responsibilities and remain governable. Ariovis avoids forcing every exception into the role model and complements roles with controlled requests or contextual authorization.
Related services
Common pitfalls
- Teams often underestimate graph complexity, inheritance effects, indirect relationship chains, and the need to explain decisions clearly to operators and auditors.
Standards and protocols
- Google Zanzibar
- OpenFGA
- SpiceDB
Explore this category
These concepts matter most inside a real project.
The first conversation helps establish your context, the systems involved and the next useful decision.