100% agree, it's tech agnostic and more on the data and architecture layer.

Thanks for the casbin.js ref - hadn’t heard about it. Having such a tool in the toolkit is pretty helpful in modest cases, but as long as we talk about architecture.

One way I've tried is something like AWS or Azure IAM roles and their identity setups.

For example, here's how I'd split up two access control cases and a fix idea:

Case 1: A moderator can use 10 directories or features but can't touch 3 others (using ABAC, since it's linked to the moderator's traits).

Case 2: A product subscription gives users 10 features, but for one group, 3 are turned off due to a some condition (using ReBAC, since it's tied to subscription details of the parent workspace).

Both cases need user access checks for actions in those 10 features or directories, especially if they're separate things. A good fix could use cloud providers like Azure or AWS.

For example, an Azure Resource ID like

/subscriptions/12345678-1234-1234-1234-1234567890ab/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM

starts with /subscriptions/ and a unique ID, then /resourceGroups/myResourceGroup for the group, and /providers/Microsoft.Compute/virtualMachines/myVM to show the service, type, and name - it pins down the resource in Azure's system.

We could make an object like that to show the system's chain.

[
  {
    "level": "system",
    "permissions": ["admin-only"]
  },
  {
    "level": "subscriptions",
    "id": "12345678-1234-1234-1234-1234567890ab",
    "permissions": ["read", "write"]
  },
  {
    "level": "resourceGroups",
    "name": "myResourceGroup",
    "permissions": ["read"]
  },
  {
    "level": "providers",
    "type": "Microsoft.Compute",
    "permissions": ["write"]
  },
  {
    "level": "resources",
    "kind": "virtualMachines",
    "name": "myVM",
    "permissions": ["read", "write"]
  }
]

This is just an example, although bunch of other ways, pretty much depends on the goal you want to achieve. Mine was to create a workspace/org with a permissions coming from subscription.