Fine Grained Authorisation with Relationship-Based Access Control - Ben Dechrai - NDC Porto 2023

[@felixmason8752]

How do you deal with a bunch of records from DB with READ access in RBAC? Do you fetch them all and do RBAC for each of them in the code? Or compile your RBAC rules into SQL filter clauses so the filter happens in DB to avoid fetching all records?

[@felixmason8752]

I mean ReBAC

[@01110100011101110110]

Yeah, it's a complex SQL filter in my experience. I have been working at a company that had support for complex permissions based on a matrix organization structure, and it was painful to support.