JAY VATS

Funnny with friends, boring otherwise.

[Ravi shankar vats @ravisvats]

When you start putting authorization in your code, you often add extra logic like “if user A shared with user B, then allow access.”

But in Zanzibar or OpenFGA, you don’t need that.
Delegation or sharing isn’t special logic — it’s just another relationship.
If Ravi is part of Group A, and Group A has access to Document X,
→ Ravi automatically inherits that access.

That’s delegation through relationships — access flows naturally through the relationship graph.
#Zanzibar #OpenFGA #AccessControl #FGA #Authorization

[Ravi shankar vats @ravisvats]

RBAC vs ReBAC — what’s the real difference?

Both decide “can user X do action Y on object Z?” —
but how they decide it is totally different 👇

🧩 RBAC (Role-Based Access Control)
Access = user’s role → permissions are global.
If you’re an Editor, you can edit any document.
Example:

Ravi ──> Role: Editor ──> edit_all_docs

✅ Simple
❌ No per-object control

🌐 ReBAC (Relationship-Based Access Control)
Access = user’s relationship with each object.
If you’re owner of Doc1, you can edit only that doc.

(ravi, owner, doc:1)
(alex, viewer, doc:1)

✅ Object-level precision
✅ Supports sharing, delegation, hierarchy

In short:

RBAC = “What’s your job title?”
ReBAC = “How are you connected to this object?”

Used by:
•RBAC → Enterprise / HR / ERP systems
•ReBAC → Google Drive, GitHub, Notion, Figma

RBAC grants access by role
ReBAC grants access by relationship

#RBAC #ReBAC #Authorization #OpenFGA #Zanzibar #Security #SaaS

[Ravi shankar vats @ravisvats]

If you’re a startup founder or a CTO scaling your product, you’ve probably felt this — managing roles and authorization starts slowing everything down.

It’s one of those invisible bottlenecks that quietly eats your team’s time and focus.

I recently wrote about how to solve this using OpenFGA and Zanzibar’s approach — it might really resonate with you.

Check for :

OpenFGA & Zanzibar Use Case | How SASSY Moved from RBAC to ReBAC?
URL in my bio.

[Ravi shankar vats @ravisvats]

When a user tries to access something (say, view a document or update a record), your authorization system either allows or denies that request.

But in complex systems — especially those using relationship-based access control (like Zanzibar or OpenFGA) — understanding why access was denied (or allowed) can be tricky.

That’s where explainability comes in.

🔹 Zanzibar (Google’s authorization system) introduced the idea of transparency — authorization shouldn’t be a black box.
🔹 OpenFGA continues this with an Explain API, which lets developers (or even admins) see exactly how a decision was reached.
For example:

“User A can’t access Document X because they’re not part of the group that owns it.”

This helps with:
✅ Debugging — quickly identifying misconfigurations or missing roles
✅ Trust — users understand why they’re denied access
✅ Compliance — easier audits and reporting

So instead of just saying “Access Denied”, modern auth systems show “Access Denied — here’s why.

[Ravi shankar vats @ravisvats]

## Auth Concepts

In systems like Zanzibar and OpenFGA, every permission can be thought of as a simple statement:

User → Relation → Object

For example:

Raj can edit Document #123

Vicky is a member of Team X

This “tuple” approach makes permissions easy to model, read, and enforce.

Here is how we store a sample for this relation:

{
"user": "raj",
"relation": "can_edit",
"object": "document:123"
}
This means raj can edit Document #123.

Every permission in OpenFGA or Zanzibar can be represented in this user–relation–object format, making access control clear, consistent, and easy to check.

[Ravi shankar vats @ravisvats]

When dealing with user Authorisation.

Treat authorization as data, not code.

When Google adopted Zaanzibar.
Zanzibar and OpenFGA store access rules as tuples — queryable, auditable, and versioned.
 That means less code and more control.

That is just a very small concept behind Google Zanzibar style Authorisation.

[Ravi shankar vats @ravisvats]

RBAC (Role-Based Access Control)
•You check the user’s role.
•Example:

if user.role == "admin":
allow_access()
else:
deny_access()

•Simple mappings: roles → permissions.
•Works fine if roles don’t change often.

ABAC (Attribute-Based Access Control)
•You check multiple attributes (user, resource, environment) using policies.
•Example:

if user.department == "finance" and resource.type == "report" and request.time < "18:00":
allow_access()
else:
deny_access()

•Dynamic checks: context-aware, fine-grained.
•Needs a policy evaluation engine or custom logic to combine attributes.

👉 As a developer:
•With RBAC, you mostly manage role-to-permission tables.
•With ABAC, you manage policies/rules and handle attribute evaluation during each access request.

[St. Broseph @St_Brosephs]

Cleared the waterlogged roads at Indiranagar today, here's a video by a friend chronicling the events.

All it takes is one person.

#StBroseph

[Ravi shankar vats @ravisvats]

Recently I have been working on Role Based Authentication System implementation using FastAPI and MySql, here is what you need to keep in mind while implementing RBAC

[Ravi shankar vats @ravisvats]

🚀 Just Started Working with #FastAPI Last Week: Here Are My Learnings

[Nitish Pandey @whonitish]

@Ravisutanjani To be able to see with the naked eyes.

[Vitto Rivabella @VittoStack]

What's the object-oriented way to become wealthy?

Inheritance.

[Ravi shankar vats @ravisvats]

What is multiprcoessing and multithreading?

[Rup Chitrak⚡ @its_rchitrak]

A 2 lakh fraud happened on my card without any OTP or call 25 successful transactions done and that too,in between I changed my PINs,disabled online transactions. Reported it within minutes, Filed an FIR for this within 24 hrs as per @RBI guidelines.@sliceit_

[Lucy Hughes @lucyhughes_PR]

24 underrated websites. A thread 🧵👇

[JAY VATS @vatsjay759]

We Indians have a weird mindset, we term bribe as "out income" as if it is a legitimate source of income, and if a private sector employee has decent income, we say he is "minting money", like he has done nothing to deserve it. 🙄🙄

[Chris Hladczuk @chrishlad]

If you loved learning about Jerry's writing system, retweet the 1st tweet below:

https://t.co/fg8QbxVOri

[Sahil Bloom @SahilBloom]

Cognitive biases are systemic errors in thinking that negatively impact decision-making quality and outcomes.

THREAD: 20 cognitive biases to learn (so you can think clearly and make better decisions):

[Ravi shankar vats @ravisvats]

Are chacha @NitishKumar @RailMinIndia thora sa pani baras gya pura #mithilanchal ko rail sewa band kar dete ho, news me aata hai pul ka pressure badh gya, thoda dimag pe pressure daloge to shayad pul ka pressure kam ho jaye @AdityaJhamohan @MaithilAnup

[Gokul ⚡️ @gokulns]

Whoever built this must be fired.