Skip to main content

Permissions (ReBAC)

The Permissions (ReBAC) screen lets you list, write and delete the relationship tuples of the tenant: who (subject) holds which relation on which object, for example user:alice can_assume service_identity:billing. Portal path: /security/permissions, menu Security and governance > Permissions (ReBAC). It is used by tenant administrators and security officers who grant fine grained access, and by any user of the tenant who checks a relation.

What the screen shows​

The screen (Permissions in portal/src/screens/security-kit.tsx) has two sections.

  • Relationship tuples table, read from GET /v1/authz/tuples (up to 1000 rows, sorted by object, relation, subject): columns Subject, Relation, Object, Created. Filters Subject (placeholder user:alice) and Object (placeholder service_identity:billing), exact match. A click on a row shows the row.
  • Delete a tuple form: "Removes one relation from the relationship engine; the change is audited.", with Subject, Relation and Object (all required).

Empty table: "No tuple", "Write a relation such as can_assume on a service identity for a named user or group."

Actions​

Button or actionWhat it doesAPI callRoles
New tuple (then Create)Writes one tuple Subject, Relation, Object to the relationship engine (OpenFGA when configured, else the built in tuples); audited as authz.write.POST /v1/authz/tuplestenant_admin, security_officer (button hidden for others)
Run (Delete a tuple)After a confirmation, deletes the tuple; the result shows deleted (0 when no such tuple) and the engine; audited as authz.delete.DELETE /v1/authz/tuplestenant_admin, security_officer (form hidden for others)
FilterApplies the Subject and Object filters.GET /v1/authz/tuples (query subject, object)Every user of the tenant
Row click or View detailsShows the row.NoneEvery user of the tenant
Refresh iconReads the list again.GET /v1/authz/tuplesEvery user of the tenant

The body of a write or a delete is one tuple:

{"subject": "user:alice", "relation": "can_assume", "object": "service_identity:billing"}

Roles​

The portal shows New tuple and the delete form to ROLES.delegationAdmins (tenant_admin, security_officer, portal/src/lib/kit.ts); other users see "Requires one of these roles" instead of the form. The Control Plane (services/control-plane/src/eai/domains/authz/__init__.py) lists the tuples for any user of the tenant and requires tenant_admin or security_officer to write or delete; platform_admin passes every role check. The relation can_assume is granted to named subjects only: a wildcard subject such as user:* is refused.

Typical tasks​

Let a user assume a service identity​

  1. Open the form. The relation can_assume lets a named user act as a service identity. Click New tuple. Expected result: a side panel with Subject, Relation, Object. If it fails: no button means you are neither tenant_admin nor security_officer.
  2. Fill the tuple. Subject user:alice, Relation can_assume, Object service_identity:billing. Expected result: the three fields filled. If it fails: nothing to retry at this step.
  3. Create. Click Create. Expected result: the message Created and the tuple in the table. If it fails: authz_wildcard_not_allowed (HTTP 422) for a subject ending with :*; authz_backend_error (HTTP 502) when OpenFGA is unreachable.
  4. Check it. Filter Subject user:alice, Filter. Expected result: the new tuple. If it fails: an empty table means the subject text differs (the match is exact).

Remove an access​

  1. Find the tuple. Filter Object with the object, Filter. Expected result: the tuples on that object. If it fails: an empty table means no relation is granted on it.
  2. Delete it. Form Delete a tuple: copy Subject, Relation, Object from the row, Run, accept the confirmation. Expected result: the result shows deleted: 1; click the refresh icon to update the table. If it fails: deleted: 0 means the three values do not match a tuple exactly.

Troubleshooting​

SymptomCauseFix
authz_wildcard_not_allowed (HTTP 422)The relation is granted to named subjects only: a wildcard subject is refused.Name the user or the group in Subject.
authz_backend_error (HTTP 502)The authorization backend (OpenFGA) failed.Check OpenFGA, then retry; the Policies screen shows its state under Policy engines.
forbidden (HTTP 403) with required_rolesWriting and deleting need tenant_admin or security_officer.Ask for one of these roles.
"Requires one of these roles"The portal hides the delete form from your roles.Use an account with one of the listed roles.
validation_error (HTTP 422)A field of the tuple is missing or malformed.Fill Subject, Relation and Object.
tenant_required (HTTP 403)The account acts without a tenant.Sign in with an account of the tenant.