Check resource relationships with OpenFGA.
OpenFGA supports relationship-based access control. An application programming interface (API) can ask whether a user has a required relationship to a specific object before returning that resource.
Why this lesson?
A team shares a planning folder with Anne. The rules should also let her read documents stored in that folder.
Learning goal and prerequisites
Request the document
The application validates the access token and connects the verified user identity to user:anne. A general document-reading scope does not show whether Anne may read this particular document.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Some permissions depend on relationships rather than a simple global role. A person might be able to read a document because they own it, because their team owns it, or because they can view the folder that contains it. As these relationships grow, hard-coded role checks become difficult to manage.
OpenFGA is designed for relationship-based authorization. The system stores relationships between users, groups, and objects, and an authorization model defines how those relationships imply permissions. The application can then ask whether a particular user has a particular relation to a particular object.
This is useful for products with sharing, teams, folders, projects, or inherited access. Instead of copying many permissions onto every document, the model can represent the relationships that create those permissions and evaluate them when needed.
OpenFGA does not authenticate the caller or fetch the protected resource. The application must first establish the correct user identity, identify the exact resource, call OpenFGA with trusted values, and enforce the returned decision. A relationship grants only the permissions that the model explicitly defines.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.