Authorization Overview

Descope lets you configure authorization in your application, with support for Role-Based Access Control (RBAC) and Relationship-Based Access Control (ReBAC).

Choosing the Right Access Control Model

Deciding whether to implement RBAC or ReBAC depends on the specific needs of your application. Below are some considerations to help you decide which model fits best.

When to Choose RBAC

• Simplicity and Scalability: If your application requires a straightforward permission model with clearly defined roles that can scale with your organization, RBAC is ideal.
• Ease of Management: RBAC's role-centric approach makes it easier to manage permissions as you can assign and change roles without modifying individual permissions.

When to Choose ReBAC

• Complex Relationships: When your application's access control needs to reflect complex relationships between users and resources, ReBAC offers the flexibility you require.
• Dynamic Permissions: If permissions need to change frequently based on context or user relationships, ReBAC can dynamically adjust access rights accordingly.
• Fine-grained Access Control: For applications that need to control access at a more granular level than roles, ReBAC provides the ability to define precise access control policies.

Authorization in Descope

Role-Based Access Control

Role-Based Access Control is a common authorization model. In RBAC, you create roles that encapsulate a certain set of permissions. These roles represent the different levels of access within your application. Once roles are defined, you can assign them to users. This model simplifies permission management by allowing you to control access based on roles rather than individual permissions.

RBAC with Permissions Checks

Rather than assigning multiple roles to a user, you can assign permissions directly. This method involves defining permissions such as "documents:read" or "documents:write". When a user attempts to perform an action, the system checks their assigned permissions to determine if the action is authorized.

Relationship-Based Access Control

Relationship-Based Access Control introduces a dynamic approach to authorization. Unlike RBAC, which is role-centric, ReBAC is relationship-centric. It allows you to define permissions based on the relationship between the user and specific resources or other users within the system. This model is particularly useful when you need to grant access to resources based on more complex conditions than roles allow.