For large number of users, managing access for entire groups can be more efficient than assigning roles to individual users.

User groups essentially define that, if you’re part of a group, you can access certain resources or perform specific actions.

Let’s demonstrate how this can be modeled using a simple project management system scenario.

entity user {}

entity organization {

    // organizational roles
    relation admin @user
    relation member @user

}

entity team {

    // represents owner or creator of the team
    relation owner @user

    // represents direct member of the team
    relation member @user

    // reference for organization that team belong
    relation org @organization

    // organization admins or owners can edit, delete the team details
    permission edit = org.admin or owner
    permission delete = org.admin or owner

    // to invite someone you need to be admin and either owner or member of this team
    permission invite = org.admin and (owner or member)

    // only owners can remove users
    permission remove_user =  owner
}

entity project {

    // references for team and organization that project belongs
    relation team @team
    relation org @organization

    permission view = org.admin or team.member
    permission edit = org.admin or team.member
    permission delete = team.member
}

​

Breaking Down

​

User Entity:

entity user {}

This is a basic entity representing a user in the system. It doesn’t have any specific relations or permissions defined.

​

Organization Entity:

entity organization {
    relation admin @user
    relation member @user
}

The organization entity has two relations: admin and member, both referencing users.

This allows users to be assigned roles within an organization.

​

Team Entity:

entity team {
    relation owner @user
    relation member @user
    relation org @organization

    permission edit = org.admin or owner
    permission delete = org.admin or owner
    permission invite = org.admin and (owner or member)
    permission remove_user = owner
}

The team entity has three relations: owner (a user), member (users), and org (the organization it belongs to).

It defines four permissions:

• edit: Organization admins or team owners can edit the team.
• delete: Organization admins or team owners can delete the team.
• invite: Organization admins who are also either team owners or members can invite others.
• remove_user: Only team owners can remove users from the team.

​

Project Entity:

entity project {
    relation team @team
    relation org @organization

    permission view = org.admin or team.member
    permission edit = org.admin or team.member
    permission delete = team.member
}

The project entity has two relations: team and org, representing the team and organization it belongs to.

It defines three permissions:

• view: Organization admins or team members can view the project.
• edit: Organization admins or team members can edit the project.
• delete: Only team members can delete the project.

This model establishes a hierarchy where organizations contain teams, which in turn contain projects. It also defines various permissions based on user roles within organizations and teams.

​

More Advance Example

See our Facebook Groups example to learn how to apply user groups in a real-world scenario.