The graph consists of three types of nodes. Object nodes that represent application objects, intermediary subject set nodes, and subject ID nodes representing individuals. Edges are directed and represent the relation between an object and subject.
The following example translates a view relation tuples into the corresponding graph of relations.
This example omits the namespace from all data to improve readability. In practice, the namespace always has to be considered.
This is represented by the following graph:
Solid edges represent explicitly defined relations, while dotted edges represent relations inherited through a subject set.
Ory Keto utilizes the following key properties of the graph of relations:
- Directed edges from objects to subjects: This implies a neat arrangement with objects in one region, subject IDs in another one, and subject sets in between. Edges will always go from the object region towards the subject region.
- Searching for a possible path is local: Trying to find a path from an object to a subject will always happen locally. This means that it is only necessary to traverse the nodes that are successors of the object. In typical setups, this means that only a small fraction of the graph has to be searched, regardless of the outcome. The intuition here is that the relations of user1's files are irrelevant when checking access to user2's files.
Both of these properties are important to ensure high performance.