{
  "id": 562029,
  "title": "ReBAC isn't the problem. The ReBAC tools I tried are.",
  "url": "https://urgent.news/2026/08/11/rebac-isnt-the-problem-the-rebac-tools-i-tried-are",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-11T12:04:43.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/adrianofoschi/rebac-isnt-the-problem-the-rebac-tools-i-tried-are-hon"
  },
  "original_language": "en",
  "account": "ReBAC (relationship-based access control) grants access based on how entities are connected, rather than on a user role. While the model intrigues me, I found integrating it into a prototype proved problematic. The tools I tested failed to provide a usable answer to the core question: \"Can this user see this object?\" The answer is fast, but the list of objects they can see is slow to generate. After trying three solutions, I removed ReBAC from the prototype. The issue lies in generating the list of objects a user can see, which appears to be the same question reversed. However, where the first question requires walking the graph to find reachable objects, the second question asks for all existing objects. The second approach involves using a service that filters objects based on a user's permissions. The problem with this method is that the list of objects is returned in its entirety, with no pagination. To resolve this, I created a \"user → what they can see\" table using native functions in Postgres. This approach allows for accurate counting and filtering of objects, without relying on an external service. While this solution works well for smaller systems, it may not scale well for larger, more complex systems with deep hierarchies and large volumes of data.",
  "summary": "ReBAC (relationship-based access control) decides access based on how entities are connected to each other, rather than on a role attached to the user. Nowhere is it written that you can see that repository. You see it because a chain of relationships leads you there. It's a model I like, and I want to say that up front, because what follows isn't a criticism of ReBAC. I spent a few weeks…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}