Models and Sub-Model Best Practices

Okta Fine Grained Authorization
1

Is there any good examples for using FGA across an organization? I think the single part I am struggling with at the moment is how to structure all this.

I work in an organization that has many many different products, api’s, services. A lot of the examples I have seen are pretty simple in their structure, user, document, folder, etc.

In a single model, creating a new user object for every API/service I think would probably be decent to start but as we add more and more of these, trying to navigate through a single model would be daunting I think.

Creating sub-models I think makes sense. However I am curious how that would be structured? I don’t know that I would want a single model for each API/service since there would a crazy amount of different sub-models.

I think there could be some divisions around sub-models relating to business divisions where the related products might exist in the same sub-model.

This is my long winded question of if there are any other good examples of people already doing this in a big organization?

2

Hi Stephen,

The reasons we see to create a module are:

  • You want each team to own their own types/relations

  • You want each application to only write tuples for the types they own (e.g. the ‘wiki’ application will write tuples for spaces/pages, the ‘issue-tracker’ app for projects/tickets). This is something we are currently working on.

If each service defines a few types/relations and you want to make sure that service is the only one that can writes tuples for those, you’d need to define a module for each service.

We could potentially add a way to define write permissions per-type and not per-module, and that might reduce the number of modules you’d need to define.

Makes sense?

3

Yah that makes sense. Are there any limits on how many modules you can have?

4

Quick follow up question about modular models.

When you have a fga.mod file that looks like this:

schema: '1.2'
contents:
  - core.fga
  - issue-tracker/projects.fga
  - issue-tracker/tickets.fga
  - wiki.fga

Does wiki.fga inherit objects from ALL three above it, or does it inherit ONLY from the core.fga model?

Basically I am wondering if there is any concept where you can have layers of inheritance or does the inheritance only go one level down?