Skip to main content
For large number of users, managing access for entire groups can be more efficient than assigning roles to individual users. User groups essentially define that, if you’re part of a group, you can access certain resources or perform specific actions. Let’s demonstrate how this can be modeled using a simple project management system scenario. 
entity user {}

entity organization {

    // organizational roles
    relation admin @user
    relation member @user

}

entity team {

    // represents owner or creator of the team
    relation owner @user

    // represents direct member of the team
    relation member @user

    // reference for organization that team belong
    relation org @organization

    // organization admins or owners can edit, delete the team details
    permission edit = org.admin or owner
    permission delete = org.admin or owner

    // to invite someone you need to be admin and either owner or member of this team
    permission invite = org.admin and (owner or member)

    // only owners can remove users
    permission remove_user =  owner
}

entity project {

    // references for team and organization that project belongs
    relation team @team
    relation org @organization

    permission view = org.admin or team.member
    permission edit = org.admin or team.member
    permission delete = team.member
}

​
Breaking Down

​
User Entity:

entity user {}
This is a basic entity representing a user in the system. It doesn’t have any specific relations or permissions defined.

​
Organization Entity:

entity organization {
    relation admin @user
    relation member @user
}
The organization entity has two relations: admin and member, both referencing users. This allows users to be assigned roles within an organization.

​
Team Entity:

entity team {
    relation owner @user
    relation member @user
    relation org @organization

    permission edit = org.admin or owner
    permission delete = org.admin or owner
    permission invite = org.admin and (owner or member)
    permission remove_user = owner
}
The team entity has three relations: owner (a user), member (users), and org (the organization it belongs to). It defines four permissions:
  • edit: Organization admins or team owners can edit the team.
  • delete: Organization admins or team owners can delete the team.
  • invite: Organization admins who are also either team owners or members can invite others.
  • remove_user: Only team owners can remove users from the team.

​
Project Entity:

entity project {
    relation team @team
    relation org @organization

    permission view = org.admin or team.member
    permission edit = org.admin or team.member
    permission delete = team.member
}
The project entity has two relations: team and org, representing the team and organization it belongs to. It defines three permissions:
  • view: Organization admins or team members can view the project.
  • edit: Organization admins or team members can edit the project.
  • delete: Only team members can delete the project.
This model establishes a hierarchy where organizations contain teams, which in turn contain projects. It also defines various permissions based on user roles within organizations and teams.

​
More Advance Example

See our Facebook Groups example to learn how to apply user groups in a real-world scenario.
⌘I