Permission System OOD - Role-Based Access Control Implementation

Question

## Problem

Design a role-based access control (RBAC) system. Users are assigned roles; roles have permissions; permissions are `(resource, action)` pairs.

Implement:
- `add_role(role_name)`
- `grant_permission(role_name, resource, action)`
- `assign_role(user_id, role_name)`
- `can(user_id, resource, action) -> bool`
- `revoke_role(user_id, role_name)`

Roles can inherit from other roles.

```python
class PermissionSystem:
    def add_role(self, role: str, inherits: str = None): ...
    def grant_permission(self, role: str, resource: str, action: str): ...
    def assign_role(self, user_id: str, role: str): ...
    def can(self, user_id: str, resource: str, action: str) -> bool: ...
    def revoke_role(self, user_id: str, role: str): ...
```

**Example:**
```
sys.add_role("viewer")
sys.add_role("editor", inherits="viewer")
sys.grant_permission("viewer", "doc", "read")
sys.grant_permission("editor", "doc", "write")
sys.assign_role("u1", "editor")
sys.can("u1", "doc", "read")  -> True   # inherited from viewer
sys.can("u1", "doc", "delete") -> False
```

## Follow-ups

1. How do you handle circular inheritance (role A inherits B inherits A)?
2. How would you scale `can()` checks to millions of requests per second?
3. Add resource wildcards (e.g., permission on `"doc:*"` covers all doc resources).
4. How would you audit who has access to a given resource?

Permission System OOD - Role-Based Access Control Implementation

Question Details

Full Details

About This Question

Topics

More Sigma Computing Interview Questions