Hey I have a question about checking permissions I've implemented simple RBAC keto.namespaces.ts

class User implements Namespace {
}

class Organization implements Namespace {
  related: {
    members: User[]
  }
}

class Role implements Namespace {
  related: {
    has: User[]
  }
}

class Permission implements Namespace {
  related: {
    allowed: (User | SubjectSet<Role, "has">)[]
  }
}

class Product implements Namespace {
  related: {
    owners: Organization[]
    viewers: SubjectSet<Permission, "allowed">[]
    editors: SubjectSet<Permission, "allowed">[]
  }

  permits = {
    view: (ctx: Context): boolean =>
        this.related.owners.traverse((org) => org.related.members.includes(ctx.subject)) &&
        (this.related.viewers.includes(ctx.subject) || this.related.editors.includes(ctx.subject)),
    edit: (ctx: Context): boolean =>
        this.related.owners.traverse((org) => org.related.members.includes(ctx.subject)) &&
        this.related.editors.includes(ctx.subject),
  }
}

Users is member of some organization User has some role Role has some permissions And permissions allow to view/edit Product My initial tuples.json

Organization    hazemag         members         User:Bob
Organization    hazemag         members         User:Alice
Organization    bmw             members         User:John
Role            developer       has             User:John
Role            developer       has             User:Bob
Role            viewer          has             User:Alice
Permission      view-products   allowed         Role:viewer
Permission      edit-products   allowed         Role:developer
Product         product/1       owners          Organization:hazemag
Product         product/1       viewers         Permission:view-products
Product         product/1       editors         Permission:edit-products
Product         product/2       owners          Organization:bmw
Product         product/2       viewers         Permission:view-products
Product         product/2       editors         Permission:edit-products

But that checks return denied

keto check User:Alice view Product product/1
 keto check User:Bob view Product product/1

Do you have any ideas why it's happening?

Has it been the

&&

? We are looking into keto as well and build up something similar 😊

no I just forget to specify "allowed" relation for those policies:

Product         product/1       viewers         Permission:view-products

it should be

Product         product/1       viewers         Permission:view-products#allowed

Ah okay thank you 👍