Implementing ReBAC has never been easier

package app.rebacimport future.keywords.in
              files[id] := file_instance {
                some file_instance in data.files
                id := sprintf("file:%s",[file_instance.id])
              }
              
              folders[id] := folder_instance {
                some team_instance in data.folders
                id := sprintf("team:%s",[folder_instance.id])
              }
              
              full_graph[subject] := ref_object {
                some subject, object_instance in object.union_n([files, files.folders])
                ref_object := [object.get(object_instance, "parent_id", null)]
              }
              
              users[id] := user {
                some user in data.users
                id := user.id
              }
              input_user := users[input.user]c
              allowing_assignments[assignment] {
                some assignment in input_user.assignments

                input.action in data.roles[assignment.role].grants

                assignment.resource in graph.reachable(full_graph, {input.resource})
              }
              default allow := false
              allow {
                count(allowing_assignments) > 0
              }