User Tools

Site Tools


security:authorization:openfga:authorization-model:keyword-vs-name

This is an old revision of the document!


OpenFGA DSL Syntax: Keywords vs Names

In the DSL there are two kinds of words: keywords you must type exactly, and names you make up (or point to). Symbols like ​:​ and [ ] are also fixed.

Keywords (fixed — you cannot change them)

Built-in words. Spell them exactly.

Keyword What it does
model Starts the file.
schema Comes with the version, like schema 1.1.
type Starts a new type.
relations Starts the list of relations for a type.
define Starts one relation.
or, and, but not Combine relations.
from Inherit through a link.

Names (values — you choose these)

Words you invent to fit your app.

  • Type names: user, document, folder, organization. You could call them person or file instead.
  • Relation names: owner, editor, viewer, parent, member. You pick these too.

There is a small twist. Sometimes you create a name, and sometimes you refer to a name you already made.

  • define viewer: … → here you create the name viewer.
  • … or owner → here you refer to owner, which must already exist.
  • [user]user must be a type you already defined.

Symbols (fixed punctuation)

  • ​:​ after a relation name — required.
  • [ ] around allowed types — required for a direct relation.
  • # — used in tuples, like group:eng#member (not in the model itself).

One line, broken into parts

Take this line:

define viewer: [user] or owner
Token Kind Note
define keyword fixed word
viewer name you create it here
​:​ symbol required
[ symbol required
user name a type that must already exist
] symbol required
or keyword fixed word
owner name a relation that must already exist

The general shape

Uppercase = keywords (fixed). <…> = names you supply.

MODEL
  SCHEMA 1.1

TYPE <your type name>
  RELATIONS
    DEFINE <your relation name>: [<allowed type>] OR <another relation>

See also

security/authorization/openfga/authorization-model/keyword-vs-name.1783570502.txt.gz · Last modified: by phong2018