<@U04UQ68083H> let's say I have some entity define...
# ory-copilot
b
@chilly-king-10285 let's say I have some entity defined via the "Ory Identity" API. Is there some standard way of convert this entity into a "subject" or "object" concept within the "Ory Permissions" ecosystem in order to support role-based access control?
c
A message from kapa.ai
Yes, there is a way to convert an entity into a "subject" or "object" within the Ory Permissions ecosystem. In Ory Keto, subjects are a recursive polymorphic datatype that refer to specific subjects by an identifier defined by the application, such as users, or to sets of subjects. A subject ID can be any string, and the application must map its resources to constant, unique identifiers. It is recommended to use UUIDs as they provide a high entropy and therefore are unique identifiers. However, you can also use URLs or opaque tokens as identifiers. Subjects are considered equal when their string representation is equal. For example, in a basic setup, an application uses the same subject identifiers as it uses internally, for example a constant, unique username like
zepatrik
or preferably UUIDv4 like
480158d4-0031-4412-9453-1bb0cdf76104
. In terms of objects, they are the resources that you want to manage. Relationships encode relations between objects and subjects. A relationship is associated with a namespace where its relation has to be defined and configured. For role-based access control (RBAC), you can use subject sets. A subject set is the set of all subjects that have a specific relation on an object. They can be used to realize RBAC or inheritance of relations. Subject sets themselves can again indirect to subject sets. For more information, you can refer to the Ory documentation on [Subjects](https://www.ory.sh/docs/keto/concepts/subjects) and [Relationships](https://www.ory.sh/docs/keto/concepts/relation-tuples).