Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hi All :wave:

I’m trying to understand the examples provided here <https://www.ory.sh/docs/keto/guides/userset-rewrites>
In particular, if it is required to use Ory Permission Language (OPL) to achieve _transitive relations_.

By transitive relations I mean that if we have (written in english, putting aside relation tuples for a moment)
1. Alice is a manager of Bob
2. Bob is a manger of John
3. John is a manger of Luke
4. Luke can read File1.txt
We would like to define permissions so that  Alice can read the File1.txt because she’s _transitive_ manager of Luke.

What are the options to achieve that with Keto?

One option we see is to add tuples
1. file:File1.txt # read @ Luke
2. user:Luke # manages @ John
3. user:John # manages @ Bob
4. user:Bob # manages @ Alice
5. file:File2 # read @ (user:Luke # manages)
6. user:Luke # manages @ (user:John # manages)
7. user:John # manages @ (user:Bob # manages)
Then an check for
file:File1.txt # read @ Alice
would return allowed (?)

However, this means that we have to add tuples like 6. and 7. for every user.

Is there a way to achieve that without OPL?