Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hi, I'm trying out the Ory Permissions Language for the first time and I'm wondering:
We have so far been using "bare" Subject IDs to represent Users, but in <https://github.com/ory/keto/blob/master/contrib/rewrites-example/relation-tuples/tuples.json|this example>, Users is a Namespace, and tuples refer to a Subject Set ({ "namespace": "User", "object": "Patrik" }) rather than just a Subject ID. Am I right in thinking that we need Users to be a Namespace in order to write rules that indirectly refer to them in `permits`? If so, are there any cases to continue using Subject ID?

Currently there is no enforcement of all the types from the OPL. We are currently building a strict mode that skips unnecessary checks by the expressions in the OPL but that is still wip. Also, see this issue for further planned changes <https://github.com/ory/keto/issues/1092|https://github.com/ory/keto/issues/1092>
So if you start from 0, go with namespaces for users, but if you want to migrate that's also easily possible, just add a placeholder user namespace for now.