This is an automated email from the ASF dual-hosted git repository.
hsluoyz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/casbin-website.git
The following commit(s) were added to refs/heads/master by this push:
new ba623533f docs: explain ABAC, ReBAC, RBAC and PBAC for new readers
ba623533f is described below
commit ba623533f17e705ab909ff68f2d310dc6ffcde39
Author: Yang Luo <[email protected]>
AuthorDate: Tue Oct 20 23:58:33 2026 +0800
docs: explain ABAC, ReBAC, RBAC and PBAC for new readers
---
docs/ABAC.mdx | 70 ++++++++++++++++++++++++++++++++++++++++----
docs/AccessControlModels.mdx | 4 +++
docs/PBAC.mdx | 24 ++++++++++-----
docs/RBAC.mdx | 53 +++++++++++++++++++++++++++++++--
docs/ReBAC.mdx | 31 ++++++++++++++++----
docs/TutorialGoRBAC.mdx | 3 +-
docs/TutorialJavaRBAC.mdx | 3 +-
docs/TutorialPythonRBAC.mdx | 3 +-
8 files changed, 168 insertions(+), 23 deletions(-)
diff --git a/docs/ABAC.mdx b/docs/ABAC.mdx
index 3f9f92c64..30af2f228 100644
--- a/docs/ABAC.mdx
+++ b/docs/ABAC.mdx
@@ -1,16 +1,35 @@
---
id: abac
-title: ABAC
-description: "Attribute-based access control (ABAC) with Casbin - pass structs
or objects to Enforce() and compare their attributes, such as the resource
owner, directly in the matcher."
-keywords: [ABAC, ABAC model]
+title: "What is ABAC? Attribute-Based Access Control with Examples"
+sidebar_label: ABAC
+description: "What attribute-based access control (ABAC) is, how it differs
from RBAC, and how to write ABAC rules in Casbin: compare user, resource and
environment attributes in the matcher or store conditions as policy."
+keywords: [ABAC, attribute-based access control, what is abac, abac model,
abac vs rbac, abac example, attribute based access control example]
authors: [hsluoyz]
---
## What is ABAC?
-**Attribute-Based Access Control (ABAC)** decides access by evaluating
**attributes** of the subject, object, and action (e.g. `resource.Owner`,
`user.Role`), not just by identity strings. Casbin keeps this simple: you pass
structs or objects into `Enforce()` and reference their fields in the matcher.
+**Attribute-based access control (ABAC)** grants or denies a request by
evaluating **attributes** against rules, instead of looking up who the user is
or which role they hold. NIST, which published the reference definition in [SP
800-162](https://csrc.nist.gov/pubs/sp/800/162/upd2/final), groups the inputs
into four kinds:
-For complete applications, see the ABAC tutorials for
[Go](/docs/go-abac-tutorial), [Node.js with
Express](/docs/nodejs-abac-tutorial), and [Python with
Flask](/docs/flask-abac-tutorial). To decide between ABAC and RBAC, see
[Choosing an access control model](/docs/access-control-models).
+| Attributes of | Examples |
+|---|---|
+| The subject (user or service) | department, clearance level, employment
type, age |
+| The object (resource) | owner, department, classification, status |
+| The action | read, edit, approve, delete |
+| The environment | time of day, IP address or network, device, location |
+
+A rule is a condition over these attributes, for example "a user may read a
document if they are in the same department as the document, during business
hours". Because the rule refers to attributes rather than to named users or
roles, new users and new documents are covered without adding any rule.
+
+Casbin keeps ABAC simple: you pass structs or objects into `Enforce()` and
reference their fields in the matcher. Complete applications are in the ABAC
tutorials for [Go](/docs/go-abac-tutorial), [Node.js with
Express](/docs/nodejs-abac-tutorial), and [Python with
Flask](/docs/flask-abac-tutorial).
+
+### ABAC vs RBAC
+
+[RBAC](/docs/rbac) decides on the user's **roles**: "editors may edit
documents". ABAC decides on **attributes**: "the owner may edit the document".
Roles are easy to audit, because you can list what a role allows and who holds
it; attributes express rules about specific records and context, such as
ownership, department or time, which roles alone cannot express without
creating one role per record. Most applications combine them: roles decide
which features a user can reach, and attribu [...]
+
+### Strengths and weaknesses
+
+- **Good at:** ownership ("only their own"), context (business hours, office
network), and data that carries its own labels (department, region,
sensitivity). One rule can replace many role grants.
+- **Weak at:** auditing. "Who can read this document?" has no direct answer;
you have to evaluate the rule against every user. Rules also need the
attributes at hand, so the application usually loads the record before the
check.
Minimal example:
@@ -76,6 +95,37 @@ Enabling JSON parameter support introduces a performance
overhead of approximate
:::
+## Environment attributes
+
+The request can carry more than `sub`, `obj` and `act`. Add a field for the
environment and pass it to `Enforce()` like any other object. This model lets
the owner edit their document at any time, and lets people from the same
department read it between 9:00 and 18:00:
+
+```ini
+[request_definition]
+r = sub, obj, act, env
+
+[policy_definition]
+p = sub, obj, act
+
+[policy_effect]
+e = some(where (p.eft == allow))
+
+[matchers]
+m = r.sub.Name == r.obj.Owner || (r.act == "read" && r.sub.Department ==
r.obj.Department && r.env.Hour >= 9 && r.env.Hour < 18)
+```
+
+```go
+type User struct{ Name, Department string }
+type Doc struct{ Name, Owner, Department string }
+type Env struct{ Hour int }
+
+doc := Doc{Name: "design.md", Owner: "alice", Department: "design"}
+bob := User{Name: "bob", Department: "design"}
+
+ok, _ := e.Enforce(bob, doc, "read", Env{Hour: 10}) // true
+ok, _ = e.Enforce(bob, doc, "read", Env{Hour: 22}) // false: outside business
hours
+ok, _ = e.Enforce(bob, doc, "edit", Env{Hour: 10}) // false: bob is not the
owner
+```
+
## Using ABAC
1. Reference attributes in the matcher (e.g. `r.sub.Role`, `r.obj.Owner`).
@@ -125,3 +175,13 @@ m = eval(p.sub_rule) && r.obj == p.obj && r.act == p.act
p, r.sub.Age > 18, /data1, read
p, r.sub.Age < 60, /data2, write
```
+
+## FAQ
+
+**Is ABAC better than RBAC?** Neither is better in general. ABAC expresses
finer rules; RBAC is easier to review. Start with roles and add attribute
conditions where roles stop fitting, such as ownership or time windows.
+
+**What is the difference between ABAC and PBAC?** ABAC says what decisions are
based on (attributes). [PBAC](/docs/pbac) says how the rules are managed: as
policy data evaluated at run time. The `eval()` pattern above is both:
attribute conditions stored as policy.
+
+**Is ABAC the same as XACML?** No. XACML is an OASIS standard language for
writing ABAC policies. Casbin does not use XACML; rules are written in the
model's matcher or stored as policy rows.
+
+**Can I try ABAC without writing code?** Yes. Pick an ABAC example in the
[online editor](/docs/online-editor) and edit the matcher and the request.
diff --git a/docs/AccessControlModels.mdx b/docs/AccessControlModels.mdx
index 9b5614528..dc3adbc1d 100644
--- a/docs/AccessControlModels.mdx
+++ b/docs/AccessControlModels.mdx
@@ -9,6 +9,8 @@ authors: [hsluoyz]
Access control models differ in one thing: **what an authorization decision is
based on**.
+**RBAC vs ABAC in short:** RBAC grants permissions to roles and assigns roles
to users, so it answers "what can editors do?" easily but cannot say "only
their own documents" without a role per document. ABAC evaluates conditions on
attributes of the user, the resource and the environment, so it handles
ownership, department and time rules naturally but is harder to audit. Most
applications use RBAC for features and add ABAC conditions for records; the
[last example on this page](#combini [...]
+
| Model | Decides on | Example rule |
|---|---|---|
| ACL (access control list) | The user | alice may edit `design.md` |
@@ -221,4 +223,6 @@ For `design.md` (type `doc`, owner alice), alice may edit
because she is an auth
**Where does PBAC fit?** PBAC describes *how* rules are managed (as policy
data evaluated at run time) more than *what* they are based on. Casbin policies
are data in every model, so any of the models above can be managed this way.
+**Which libraries and platforms support both RBAC and ABAC?** Casbin supports
both, and their combination, in one model for Go, Java, Node.js, Python, .NET,
Rust and other languages. Policy engines such as [OPA](/docs/casbin-vs-opa) and
[Cedar](/docs/casbin-vs-cedar) can express both as well, while Zanzibar-style
services such as [OpenFGA](/docs/casbin-vs-openfga) are built around ReBAC.
[Casbin vs. Alternatives](/docs/comparison) compares them.
+
**Does Casbin support all of these?** Yes, along with others such as
[RBAC96](/docs/rbac-96), [OrBAC](/docs/orbac), [UCON](/docs/ucon), and priority
and deny-override policies. See [Supported models](/docs/supported-models), and
try any of them in the [online editor](/docs/online-editor).
diff --git a/docs/PBAC.mdx b/docs/PBAC.mdx
index 99795b372..79b93caa9 100644
--- a/docs/PBAC.mdx
+++ b/docs/PBAC.mdx
@@ -1,11 +1,15 @@
---
id: pbac
-title: PBAC
-description: "Policy-based access control (PBAC) in Casbin - store rule
expressions in policy and evaluate them at runtime with eval() for
context-dependent decisions."
+title: "What is PBAC? Policy-Based Access Control in Casbin"
+sidebar_label: PBAC
+description: "What policy-based access control (PBAC) is, how it differs from
ABAC and RBAC, and how to store rule expressions as policy in Casbin and
evaluate them at runtime with eval()."
keywords:
[
pbac,
policy-based access control,
+ what is pbac,
+ pbac vs abac,
+ pbac vs rbac,
dynamic policies,
rule-based authorization,
]
@@ -14,14 +18,20 @@ authors: [casbin]
## What is PBAC?
-**PBAC (Policy-Based Access Control)** decides authorization from **rules
stored in policy**, evaluated at runtime with `eval()`. Unlike fixed role or
attribute checks, PBAC can express complex, context-dependent conditions.
+**Policy-based access control (PBAC)** keeps authorization rules as **policy
data**, separate from application code, and evaluates them at runtime. Changing
who may do what means editing a policy, not shipping a new release, which is
why PBAC is often chosen when security or compliance teams own the rules.
+
+In Casbin, PBAC means storing rule expressions in policy rows and evaluating
them with `eval()`. Unlike fixed role or attribute checks in the model, each
policy row can carry its own condition.
Policies can include:
-- **Dynamic expressions** — evaluated per request (e.g. `r.sub.Age >= 18`)
-- **Complex logic** — boolean and comparison operators, attribute access
-- **Context** — user, resource, and environment attributes
-- **Business rules** — domain-specific logic in policy
+- **Dynamic expressions**: evaluated per request (e.g. `r.sub.Age >= 18`)
+- **Complex logic**: boolean and comparison operators, attribute access
+- **Context**: user, resource, and environment attributes
+- **Business rules**: domain-specific logic in policy
+
+### PBAC vs ABAC vs RBAC
+
+[RBAC](/docs/rbac) and [ABAC](/docs/abac) describe **what** a decision is
based on: roles, or attributes. PBAC describes **how** the rules are managed:
as policy evaluated at runtime. The two overlap. The examples on this page are
ABAC conditions managed as PBAC, and a Casbin RBAC policy is also data that can
change at runtime. In practice, "PBAC" is used for systems where the rule logic
itself, not only the assignments, lives in policy. [Choosing an access control
model](/docs/access-co [...]
## Model
diff --git a/docs/RBAC.mdx b/docs/RBAC.mdx
index 10fbd58df..971eb5c40 100644
--- a/docs/RBAC.mdx
+++ b/docs/RBAC.mdx
@@ -1,11 +1,58 @@
---
id: rbac
-title: RBAC
-description: "Role-based access control (RBAC) in Casbin - define roles with
role_definition, assign users to roles, build role hierarchies and use roles in
matchers."
-keywords: [RBAC, role definition, role hierarchy]
+title: "What is RBAC? Role-Based Access Control in Casbin"
+sidebar_label: RBAC
+description: "What role-based access control (RBAC) is and how to use it in
Casbin: define roles with role_definition, assign users to roles, build role
hierarchies and check roles in matchers."
+keywords: [RBAC, role-based access control, what is rbac, rbac model, rbac
example, role definition, role hierarchy, rbac vs abac]
authors: [hsluoyz]
---
+## What is RBAC?
+
+**Role-based access control (RBAC)** grants permissions to **roles** instead
of to individual users, and gives each user one or more roles. To let a new
employee do their job you assign them a role such as `editor` or `billing`; to
change what all editors can do you change the role once.
+
+RBAC has three parts:
+
+- **Users**: people or services that make requests.
+- **Roles**: named job functions, such as `admin`, `editor` or `viewer`.
+- **Permissions**: an action on a resource, such as `edit` on `/articles`.
+
+A request is allowed when one of the user's roles holds the permission. Roles
can also **inherit** from other roles: if `editor` inherits from `viewer`,
editors get everything viewers can do. RBAC was formalized by NIST in the
1990s, and the RBAC96 family of models describes the variants: flat roles, role
hierarchies and constraints. See [RBAC vs. RBAC96](/docs/rbac-96) for how
Casbin maps to them.
+
+A minimal RBAC model and policy in Casbin:
+
+```ini
+[request_definition]
+r = sub, obj, act
+
+[policy_definition]
+p = sub, obj, act
+
+[role_definition]
+g = _, _
+
+[policy_effect]
+e = some(where (p.eft == allow))
+
+[matchers]
+m = g(r.sub, p.sub) && r.obj == p.obj && r.act == p.act
+```
+
+```csv
+p, editor, article, edit
+p, viewer, article, read
+
+g, editor, viewer
+g, alice, editor
+g, bob, viewer
+```
+
+alice may edit and read articles (`editor` inherits `viewer`); bob may only
read them.
+
+**RBAC vs ABAC:** RBAC is easy to audit but cannot say "only their own
records" without creating a role per record. [ABAC](/docs/abac) adds conditions
on attributes such as the owner or the time of day, and most applications
combine both. [Choosing an access control model](/docs/access-control-models)
compares ACL, RBAC, ABAC and ReBAC on one example.
+
+**Tutorials:** add RBAC to a web API in [Go with Gin](/docs/go-rbac-tutorial),
[Node.js with Express](/docs/nodejs-rbac-tutorial),
[NestJS](/docs/nestjs-rbac-tutorial), [Python with
FastAPI](/docs/python-rbac-tutorial), [Java with Spring
Boot](/docs/java-rbac-tutorial), [Rust](/docs/rust-rbac-tutorial) or
[gRPC](/docs/grpc-rbac-tutorial). You can also try the RBAC examples in the
[online editor](/docs/online-editor).
+
## Role definition
The `[role_definition]` section defines RBAC role (inheritance) relationships.
Casbin can run several RBAC systems at once: one for users (with role
inheritance) and optionally one for resources. Each is independent.
diff --git a/docs/ReBAC.mdx b/docs/ReBAC.mdx
index 54cce1312..6ccd8b77e 100644
--- a/docs/ReBAC.mdx
+++ b/docs/ReBAC.mdx
@@ -1,13 +1,14 @@
---
id: rebac
-title: ReBAC
-description: "Relationship-based access control (ReBAC) with Casbin -
authorize users through their relationships to resources and resource types."
-keywords: [ReBAC, ReBAC model]
+title: "What is ReBAC? Relationship-Based Access Control with Examples"
+sidebar_label: ReBAC
+description: "What relationship-based access control (ReBAC) is, how it
relates to Google Zanzibar, how it differs from RBAC and ABAC, and how to model
user-resource relationships in Casbin."
+keywords: [ReBAC, relationship-based access control, what is rebac, rebac
model, rebac vs rbac, rebac vs abac, zanzibar, relationship tuples]
authors: [D0000M]
---
## What is ReBAC?
-**ReBAC (Relationship-Based Access Control)** bases authorization on
**relationships** between entities (user–resource, resource–type, etc.), not
only on roles or attributes. It fits systems with rich relationship graphs:
social networks, collaboration tools, multi-tenant apps.
+**Relationship-based access control (ReBAC)** decides access from
**relationships** between users and resources: alice is the *owner* of a
document, bob is a *viewer* of it, the document is *in* a folder, the folder
*belongs to* a team. Rules are written once per type of relationship, for
example "owners may edit, viewers may read", and every user gets access through
the relationships recorded for them.
Typical questions ReBAC answers:
@@ -15,7 +16,21 @@ Typical questions ReBAC answers:
- Is the user a **member** of the project that owns the resource?
- Does the resource **belong to a type** the user has access to?
-Relationships are often modeled as graphs or paths.
+It fits applications where sharing is part of the product: document and file
sharing, collaboration tools, project trackers, social networks and
multi-tenant SaaS.
+
+### ReBAC and Google Zanzibar
+
+ReBAC became widely known through Google's paper on
[Zanzibar](https://research.google/pubs/zanzibar-googles-consistent-global-authorization-system/)
(USENIX ATC 2019), the system behind sharing in Google Drive, Calendar and
other services. Zanzibar stores relationships as **tuples** of object, relation
and user, such as `doc:design.md#viewer@user:bob`. Open-source services such as
OpenFGA and SpiceDB follow the same design. In Casbin the same fact is one
policy row, `g, bob, design.md, [...]
+
+### ReBAC vs RBAC vs ABAC
+
+| | Access comes from | Example rule |
+|---|---|---|
+| [RBAC](/docs/rbac) | The user's role, the same for every resource | editors
may edit documents |
+| ReBAC | The user's relationship to this particular resource | the owner of a
document may edit it |
+| [ABAC](/docs/abac) | Attributes of the user, resource and environment |
people in the document's department may read it during business hours |
+
+RBAC with a role per resource ("alice is editor *of doc1*") is already a
simple form of ReBAC, which is how Casbin models it below. [Choosing an access
control model](/docs/access-control-models) works through one example in every
model and compares them side by side.
## ReBAC in Casbin
@@ -56,3 +71,9 @@ g2, doc1, doc
```
So: the user must have the right **role on the resource** and the resource
must match the **type** in the permission rule. Casbin combines `g`
(user–resource–role), `g2` (resource–type), and `p` (role–type–action) to
decide access.
+
+## FAQ
+
+**Do I need a Zanzibar-style service to use ReBAC?** No. If relationships fit
in your application's database and checks happen inside your service, a library
such as Casbin is enough. A dedicated service makes sense when many services
must share one relationship store; see [Casbin vs.
OpenFGA](/docs/casbin-vs-openfga).
+
+**Can I try this model without writing code?** Yes. Choose the ReBAC example
in the [online editor](/docs/online-editor).
diff --git a/docs/TutorialGoRBAC.mdx b/docs/TutorialGoRBAC.mdx
index 2702fcba0..b88952058 100644
--- a/docs/TutorialGoRBAC.mdx
+++ b/docs/TutorialGoRBAC.mdx
@@ -1,6 +1,7 @@
---
id: go-rbac-tutorial
-title: RBAC in Go with Gin
+title: "Golang RBAC Tutorial: Role-Based Access Control in Gin"
+sidebar_label: RBAC in Go with Gin
description: Step-by-step Go RBAC tutorial - add role-based access control to
a Gin REST API with Casbin, including the model, policy, middleware, and
runtime role management.
keywords: [golang rbac, go rbac, gin rbac, gin casbin, golang authorization
library, role-based access control go]
authors: [hsluoyz]
diff --git a/docs/TutorialJavaRBAC.mdx b/docs/TutorialJavaRBAC.mdx
index bf8aee828..3ab993bb1 100644
--- a/docs/TutorialJavaRBAC.mdx
+++ b/docs/TutorialJavaRBAC.mdx
@@ -1,6 +1,7 @@
---
id: java-rbac-tutorial
-title: RBAC in Java with Spring Boot
+title: "Spring Boot RBAC Tutorial: Role-Based Access Control with jCasbin"
+sidebar_label: RBAC in Java with Spring Boot
description: Step-by-step Java RBAC tutorial - add role-based access control
to a Spring Boot REST API with jCasbin, including the model, policy,
interceptor, and runtime role management.
keywords: [spring boot rbac, java rbac, jcasbin, spring boot authorization,
role-based access control java]
authors: [hsluoyz]
diff --git a/docs/TutorialPythonRBAC.mdx b/docs/TutorialPythonRBAC.mdx
index 55295524c..7e109219a 100644
--- a/docs/TutorialPythonRBAC.mdx
+++ b/docs/TutorialPythonRBAC.mdx
@@ -1,6 +1,7 @@
---
id: python-rbac-tutorial
-title: RBAC in Python with FastAPI
+title: "Python RBAC Tutorial: Role-Based Access Control in FastAPI"
+sidebar_label: RBAC in Python with FastAPI
description: Step-by-step Python RBAC tutorial - add role-based access control
to a FastAPI REST API with PyCasbin, including the model, policy, dependency,
and runtime role management.
keywords: [python rbac, fastapi rbac, pycasbin, python rbac library, fastapi
authorization, role-based access control python]
authors: [hsluoyz]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
