Differences

This shows you the differences between two versions of the page.

--- security:authorization:openfga:authorization-model:keyword-vs-name [2026/07/09 04:32] – phong2018
+++ security:authorization:openfga:authorization-model:keyword-vs-name [2026/07/09 04:36] (current) – phong2018
@@ Line 67: / Line 67: @@
     DEFINE <your relation name>: [<allowed type>] OR <another relation>
 </code>
-===== More examples to read =====
-The trick to reading a relation is to say it out loud in plain words. Below, the
-left side is the DSL, the right side is how you say it.
-==== Direct grant ====
-<code>
-define owner: [user]
-</code>
-Read it as: **"a user can be assigned as the owner."** \\
-Keyword: ''define''. Names: ''owner'', ''user''. This one needs a tuple to be true.
-==== Union with ''or'' ====
-<code>
-define editor: [user] or owner
-</code>
-Read it as: **"an editor is a user assigned directly, //or// anyone who is already
-an owner."** \\
-So every owner is also an editor, for free.
-==== More than one allowed type ====
-<code>
-define member: [user, group#member]
-</code>
-Read it as: **"a member can be a single user, //or// every member of a group."** \\
-The comma lists two allowed types. ''group#member'' means "the members of a group."
-==== Public access with a wildcard ====
-<code>
-define viewer: [user:*]
-</code>
-Read it as: **"every user can view this."** \\
-The ''*'' is a wildcard. Use it for public things.
-==== Both must be true with ''and'' ====
-<code>
-define can_delete: owner and admin
-</code>
-Read it as: **"you can delete only if you are //both// an owner //and// an admin."** \\
-''and'' means both conditions must hold at the same time.
-==== Take away with ''but not'' ====
-<code>
-define viewer: [user] but not blocked
-</code>
-Read it as: **"a viewer is any assigned user, //except// anyone who is blocked."** \\
-''but not'' removes people, even if they would otherwise qualify.
-==== Inherit through a link with ''from'' ====
-<code>
-define viewer: viewer from parent
-</code>
-Read it as: **"you can view this if you are a viewer of its parent."** \\
-Follow the ''parent'' link, then check ''viewer'' on whatever you land on.
-==== Everything combined ====
-<code>
-define viewer: [user] or editor or viewer from parent
-</code>
-Read it as: **"a viewer is a user assigned directly, //or// an editor, //or// a
-viewer of the parent folder."** \\
-This is the common real-world pattern: direct people, higher roles, and inherited
-folder access all at once.
-===== Quick reading table =====
-^ DSL ^ Read it as ^
-| ''[user]'' | assigned directly, needs a tuple |
-| ''[user, team#member]'' | a user, or every member of a team |
-| ''[user:*]'' | everyone (public) |
-| ''or owner'' | also counts if you are an owner |
-| ''and admin'' | only if you are also an admin |
-| ''but not blocked'' | unless you are blocked |
-| ''viewer from parent'' | if you are a viewer of the parent |
-<note tip>
-Rule of thumb: ''[ ]'' means a //direct// grant (a tuple sets it). A bare relation
-name means a //computed// grant (worked out from other relations, no tuple needed).
-</note>
 ===== The keywords as concepts =====
@@ Line 280: / Line 183: @@
 </note>
-===== See also =====
+===== More examples to read =====
-  * [[security:authorization:openfga:authorization-model|Authorization model]]
+The trick to reading a relation is to say it out loud in plain words. Below, the
-  * [[security:authorization:openfga:relationship-tuples|Relationship tuples]]
+left side is the DSL, the right side is how you say it.
+==== Direct grant ====
+<code>
+define owner: [user]
+</code>
+Read it as: **"a user can be assigned as the owner."** \\
+Keyword: ''define''. Names: ''owner'', ''user''. This one needs a tuple to be true.
+==== Union with ''or'' ====
+<code>
+define editor: [user] or owner
+</code>
+Read it as: **"an editor is a user assigned directly, //or// anyone who is already
+an owner."** \\
+So every owner is also an editor, for free.
+==== More than one allowed type ====
+<code>
+define member: [user, group#member]
+</code>
+Read it as: **"a member can be a single user, //or// every member of a group."** \\
+The comma lists two allowed types. ''group#member'' means "the members of a group."
+==== Public access with a wildcard ====
+<code>
+define viewer: [user:*]
+</code>
+Read it as: **"every user can view this."** \\
+The ''*'' is a wildcard. Use it for public things.
+==== Both must be true with ''and'' ====
+<code>
+define can_delete: owner and admin
+</code>
+Read it as: **"you can delete only if you are //both// an owner //and// an admin."** \\
+''and'' means both conditions must hold at the same time.
+==== Take away with ''but not'' ====
+<code>
+define viewer: [user] but not blocked
+</code>
+Read it as: **"a viewer is any assigned user, //except// anyone who is blocked."** \\
+''but not'' removes people, even if they would otherwise qualify.
+==== Inherit through a link with ''from'' ====
+<code>
+define viewer: viewer from parent
+</code>
+Read it as: **"you can view this if you are a viewer of its parent."** \\
+Follow the ''parent'' link, then check ''viewer'' on whatever you land on.
+==== Everything combined ====
+<code>
+define viewer: [user] or editor or viewer from parent
+</code>
+Read it as: **"a viewer is a user assigned directly, //or// an editor, //or// a
+viewer of the parent folder."** \\
+This is the common real-world pattern: direct people, higher roles, and inherited
+folder access all at once.
+===== Quick reading table =====
+^ DSL ^ Read it as ^
+| ''[user]'' | assigned directly, needs a tuple |
+| ''[user, team#member]'' | a user, or every member of a team |
+| ''[user:*]'' | everyone (public) |
+| ''or owner'' | also counts if you are an owner |
+| ''and admin'' | only if you are also an admin |
+| ''but not blocked'' | unless you are blocked |
+| ''viewer from parent'' | if you are a viewer of the parent |
+<note tip>
+Rule of thumb: ''[ ]'' means a //direct// grant (a tuple sets it). A bare relation
+name means a //computed// grant (worked out from other relations, no tuple needed).
+</note>
 ===== See also =====
@@ Line 289: / Line 283: @@
   * [[security:authorization:openfga:authorization-model|Authorization model]]
   * [[security:authorization:openfga:relationship-tuples|Relationship tuples]]