Hierarchal Permissions

[abdallahkorraim]

Hello,

i am exploring SpiceDB for our startup and i have a schema that i am trying to figure out if it can be implemented in SpiceDB or not.

1. Entities
2. Spaces can be created under entities
3. Drive (files and folders) that can be created under each space. each file and folder can be shared with space users
4. Tasks. based on space users roles, users can either access all tasks or assigned tasks only.
5. Entity Roles for each entity. in which there will be standard roles created by the system for all entities as well as custom roles created by the entity owner that will hold permissions for various document types under the entity.
6. Space Roles for each space. in which there will be standard roles created by the system for all spaces as well as custom roles created by the space owner that will hold permissions for various document types under the space

Notes:

1. some roles can have access to all child documents without having to explicitly share the document with. for example entity owners can access all spaces without having to be a space user. and space owners can for example access all tasks without having to be assigned to it. and it is not limited to the owner role, custom roles can also have this permissions if the owner allowed it.
2. a single system user can be user for multiple entities with different roles. for example a user can be an owner in entity1 and member in entity2 and custom-admin in entity3
3. drive folder will also have such permissions in which if have editor on a folder can access all of its files

thanks in advance, i just wanted to make sure if that is possible or applicable in SpiceDB before diving more into it

[josephschorr]

Yep, this is all possible. I'd recommend starting to model in the SpiceDB Playground (https://play.authzed.com/), and if you have any questions, please don't hesitate to jump in the Discord (https://discord.gg/spicedb) for help.

A reference on custom roles: https://authzed.com/blog/google-cloud-iam-modeling

The playground also contains various examples