Tuple Based Question

Auth0 Fine-Grained Authorization
1

I see there are several examples around entitlement based examples. However I am maybe coming at this issue from a slightly different angle.

I have the concept around creating an order tuple object and the order could be for a normal external customer, however the order could also be some an internal team member.

I am wondering if it makes sense to be able to mark the order as an internal team member and then check to see if someone is approved to view orders that are for internal team members? Or does it make more sense to have a separate order type that is only for internal team members?

2

Hi @stephenbawks1

Both can work. If conceptually it’s the same “order” entity.

Do you have other use cases where you can to differentiate between an internal user and external user? If so, it would make sense to have different user types, eg:

type user
type internal_user
type order
  relations
     define viewer : [user, internal_user]

If this is the only scenario where you want to differentiate them, maybe having an internal-order type would help.

Does it make sense?

3

Yah that makes sense what you are suggesting, however I think i perhaps did a poor job explaining it.

There is an order type and today there is basically a flag on an order that specifies this is for an internal team member. This is basically a special type that is considered more sensitive as we do not want anyone to be able to view other team member personal information.

When an order is flagged as being for an internal team member, there are only a small subset of internal team members that need to be approved to service those orders.

So the second dimension to this is that a team_member also needs to be approved or be part of a group I suppose to even be able to service those orders.

I am wondering if it makes sense to establish a relationship between the two or if a condition is better suited for something like this.

4

Hi Stephen,

I don’t think I understand yet.

The way we usually model flags is by providing a way to relate the object with itself, e.g.

type user
type internal_user
type order
  relations
     define viewer : [team#member]
     define internal_order_viewer : [team#member]

     define viewer :  viewer or internal_order_viewer from internal_order 
     define internal_order : [order]
``

Does that help? If you want to jump on a call we can try that too.
5

Yah I think that works. Let me see what I can do here and test this out.

Thank you.