ReBAC

What is ReBAC?

ReBAC (Relationship-Based Access Control) is an authorisation model in which permissions are derived from relationships between objects in the system, rather than from directly assigned roles. Conceptually it originates from Google Zanzibar — Google’s internal authorisation system published in 2019, which manages permissions across services such as Drive, YouTube, and Cloud Platform. Open-source implementations (OpenFGA, SpiceDB, Ory Keto) have made this model available to other companies as well.

In ReBAC, permissions are expressed as “subject has relationship X to object Y”. Example:

• user:anna is member of team:project-acme
• team:project-acme is owner of document:contract-2025
• Rule: if a user is a member of the team that owns the document → the user can read the document

Advantages over RBAC:

• Hierarchies and organisations — access inherits from parent-child relationships
• Sharing between users — typical SaaS scenario (“share document with person X”)
• Fine granularity without a role explosion

Disadvantage: greater technical complexity, requiring a specialised authorisation service.

When it is used

ReBAC is suitable for:

• Multi-tenant SaaS with complex customer hierarchies
• Collaboration tools (documents, projects, teams)
• Microservice architectures where one authorisation layer serves many services
• Scenarios with dynamic sharing between users

See the Security page and the API page.

Related terms

• RBAC — the simpler model, typical in classic ERP. See /en/glossary/rbac.
• SSO — the identity layer above which ReBAC runs. See /en/glossary/sso.
• GDPR — ReBAC enables precise data minimisation. See /en/glossary/gdpr.

In Modulario

Modulario uses the ReBAC layer for fine-grained permissions — a project manager sees only the teams they belong to; a salesperson only the customers assigned to them; an external consultant only the documents shared for a specific project. Configuration is via the Records module or API.

Multi-entity companies use ReBAC to separate subsidiaries — each subsidiary has its own workspace, a central auditor can see data for all entities via a “group auditor” relationship, but a local accountant only sees their own entity. Performance-wise, Modulario can perform authorisation checks in milliseconds even with tens of millions of relations.