#Check Count

1 messages · Page 1 of 1 (latest)

junior creek
#

Hi @arctic marsh the check_count signifies the number of checks that were performed to arrive at the permission decision. This provides insight into the operation of the Permify authorization engine, indicating how many individual permission checks the system executed to determine whether the request should be allowed or denied.

arctic marsh
#

Okay, thank you, I get this. I have another question here: I want to design a role that can do anything in any entity. Besides setting admin for each entity, is there any other way?

junior creek
#

Yes, there is a way. You can define a global admin role within a top-level entity such as an organization, and then use relationship-based access control (ReBAC) to spread the admin permissions across other entities.
Such as:

entity organization {
  relation admin @user
}

entity project {
  relation owner @organization#admin
}

entity task {
  relation allowed @project#owner
}

In this abstract example, users who are admin of an organization can be granted owner permissions on a project, and similarly, task permissions can be inherited or granted based on the project's owner role.

Is that solve your case ?

arctic marsh
#

This is my current schema. Let's take an example: suppose we have created many spaces, then each space has to inherit the relationship from the group. Is there a way to avoid inheriting from the group, such that being an admin alone would grant access permissions to all spaces, making data storage more concise?

#

entity user {}

entity group {
relation super_admin @user
relation internal_operator @user
}

entity space{
relation group @group
relation owner @user
relation partner @user

permission edit = group or owner or partner 
permission delete = group.or owner

}

#

we have to write the relation between space and group when I create a space

#

In fact, in our application scenario, there is only one group.

junior creek
#

If you have only one group (most high level entity I guess) still my suggestion still the same. Your schema looks legit to me. Permify designed as being capable of storing and managing trillions of authorization data so explicitly defining all super_admins in the highest level seems right way to go.

#

But I'd love to learn more your use case and concerns around data storage (or about any topic, questions, etc). Would you be against a quick call in your availability ?

arctic marsh
#

Of course, that would be fine, but I haven't finished the design yet. Let's wait until next week for me to summarize other questions and then we can discuss further.

junior creek