ReBAC (Relationship-Based Access Control)
ReBAC grants access based on relationships between entities — "is a member of," "is the guardian of," "is a client of" — rather than fixed roles, letting permission checks follow the actual structure of who is connected to what.
Role-based access control answers "what role does this person have?" and grants permissions accordingly. That works cleanly for org-wide roles like admin or member, but it strains against relationships that are specific to a pairing of entities — a guardian's access to one particular learner's account, a client's access to one particular project's thread, a manager's access to their own direct reports and nobody else's.
Relationship-based access control models those pairings directly, as tuples: (subject, relationship, object) — "Alice is the guardian_of Learner-42," "Bob is a client_of Project-Aurora." A permission check walks these relationships rather than consulting a flat role table, which makes fine-grained, per-relationship access expressible without an explosion of custom one-off roles.
ReBAC and RBAC aren't mutually exclusive — most real systems use role bundles for broad, org-level permissions and relationship tuples for the fine-grained cases roles handle awkwardly, like channel membership, guardian access, or client-portal scoping. The relationship model is specifically good at the "this person, this one thing" pattern that a role table struggles to express cleanly.
ReBAC (Relationship-Based Access Control), in the product
Aanty combines role bundles with relationship tuples — member_of, guardian_of, client_of — to gate channel and portal access. A client portal grant, a guardian's education-tier visibility, and a channel membership are all expressed as relationships, checked alongside RBAC role bundles for org-wide permissions.
Related terms and pages
See ReBAC (Relationship-Based Access Control) in a real workspace
Bring a channel from wherever your team works today. In fifteen minutes we'll show what rebac (relationship-based access control) looks like on a real conversation, not a slide.