nmathew98 / whack Goto Github PK

Based on: Core RBAC description at https://csrc.nist.gov/csrc/media/projects/role-based-access-control/documents/rbac-std-draft.pdf

• Entities are assigned to roles (many to many)
• Permissions are assigned to roles (many to many)
• Able to query an entity's role
• Able to query entities by role
• Able to query permissions assigned to a role
• Able to query roles assigned to a permission
• Able to set permission priority (relatively), with lowest priority (0) being the most
  • Specify permissions in priority order
  • Specify some permission x to be of higher priority than some other permission y
  • In effect, x is placed to the left of y
  • Each permission can only belong to at most one priority group
• Able to check if an entity has a specific permission
  • The least restrictive set of permissions apply
  • So if one role grants read access and one role grants write access then write takes effect

Hierarchical roles:

• Composition of one or more roles
  • Inherits from: x, y, z

One time grant:

• Grant an entity a role which can only be activated once. Once activated, the role is only active for x minutes/hours/days/weeks
• The grant is activated the next time access check is activated
• If the entity's roles are queried, the pending grant shows but its status is pending
• Revoke a grant