Privilege Resolution: Resolve Effective User Permissions from a Role Hierarchy

Question

## Problem

You have a permission system with roles. Each role can inherit from other roles. Each role also has explicit ALLOW or DENY rules for named permissions. DENY always overrides ALLOW. Given a user's assigned roles, compute their effective set of allowed permissions.

Resolution order:
1. Collect all permissions from the user's roles and all ancestor roles (BFS/DFS).
2. If any role in the chain DENY's a permission, it is denied globally.
3. Otherwise, if any role ALLOW's it, it is allowed.

```python
from typing import List, Dict, Set

def resolve_permissions(
    roles: Dict[str, dict],
    user_roles: List[str]
) -> Set[str]:
    # roles: {role_name: {"inherits": [str], "allow": [str], "deny": [str]}}
    # return: set of effective allowed permissions
    pass
```

**Example:**
```
roles = {
  "admin":   {"inherits": [], "allow": ["read","write","delete"], "deny": []},
  "auditor": {"inherits": ["admin"], "allow": [], "deny": ["delete"]},
}
user_roles = ["auditor"]
Output: {"read", "write"}  # delete is denied by auditor
```

## Follow-ups

1. How do you detect and handle cycles in the role inheritance graph?
2. What if DENY in a child role should NOT override ALLOW in a parent — how would resolution logic change?
3. How would you cache resolved permission sets efficiently as the role graph changes?
4. How does this model compare to RBAC vs. ABAC systems?

Privilege Resolution: Resolve Effective User Permissions from a Role Hierarchy

Question Details

Full Details

Topics

More from Snowflake