access-control-models

Access Control Models

RBAC, ABAC, ReBAC patterns -- when to use which, implementation guidance, and common pitfalls.

Knowledge Base

Access Control Model Comparison

Decision Framework

Does access depend on WHO the user is (their role)?
  YES → Start with RBAC

Do you need decisions based on CONTEXT (time, location, device, risk)?
  YES → Layer ABAC on top of RBAC

Does access depend on RELATIONSHIPS between objects (owner, shared-with, org member)?
  YES → Consider ReBAC

Is the permission model mostly static (roles change rarely)?
  YES → RBAC is sufficient

Do you have many resources with different sharing patterns?
  YES → ReBAC (Google Zanzibar model)

Patterns

Pattern 1: RBAC Implementation (Application Level)

# Role-Based Access Control implementation
from enum import Enum
from functools import wraps

class Permission(Enum):
    READ_REPORTS = "reports:read"
    WRITE_REPORTS = "reports:write"
    DELETE_REPORTS = "reports:delete"
    MANAGE_USERS = "users:manage"
    VIEW_AUDIT_LOG = "audit:read"
    MANAGE_SETTINGS = "settings:manage"

# Role definitions: map roles to permissions
ROLE_PERMISSIONS = {
    "viewer": {
        Permission.READ_REPORTS,
    },
    "analyst": {
        Permission.READ_REPORTS,
        Permission.WRITE_REPORTS,
        Permission.VIEW_AUDIT_LOG,
    },
    "manager": {
        Permission.READ_REPORTS,
        Permission.WRITE_REPORTS,
        Permission.DELETE_REPORTS,
        Permission.VIEW_AUDIT_LOG,
    },
    "admin": {
        Permission.READ_REPORTS,
        Permission.WRITE_REPORTS,
        Permission.DELETE_REPORTS,
        Permission.MANAGE_USERS,
        Permission.VIEW_AUDIT_LOG,
        Permission.MANAGE_SETTINGS,
    },
}

def require_permission(permission: Permission):
    """Decorator that checks if the current user has the required permission."""
    def decorator(func):
        @wraps(func)
        def wrapper(*args, **kwargs):
            user = get_current_user()
            user_permissions = set()
            for role in user.roles:
                user_permissions.update(ROLE_PERMISSIONS.get(role, set()))

            if permission not in user_permissions:
                log_auth_failure(user, permission, func.__name__)
                raise PermissionDeniedError(
                    f"Permission {permission.value} required"
                )

            log_auth_success(user, permission, func.__name__)
            return func(*args, **kwargs)
        return wrapper
    return decorator

# Usage
@require_permission(Permission.DELETE_REPORTS)
def delete_report(report_id: str):
    """Only users with DELETE_REPORTS permission can call this."""
    ...