# API Authorization Rbac Abac

> Design API authorization with RBAC, ABAC, and ReBAC: PEP/PDP separation, object-level checks against BOLA/BFLA, and OAuth scopes. Use when implementing permissions or reviewing IDOR risks.

- Skill: `deangrant/api-authorization-rbac-abac` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add deangrant/api-authorization-rbac-abac`
- Raw SKILL.md: https://api.skillmd.com/api/skills/deangrant/api-authorization-rbac-abac/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: deangrant (https://skillmd.com/u/deangrant)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/deangrant/api-authorization-rbac-abac

---


# Authorization Models: RBAC, ABAC, ReBAC

Use this skill when deciding **what an authenticated caller may do**.

---

## 1. Models

| Model | Idea |
| ----- | ---- |
| RBAC | Roles → permissions |
| ABAC | Attributes / policies |
| ReBAC | Relationship tuples (e.g. OpenFGA) |

Hybrid is common. Enforce via **PEP** at API edge + **PDP** policy engine.

---

## 2. Must-haves

- Every object access checks ownership/tenant/relationship (**anti-BOLA**).
- Admin routes check role/scope, not just valid token (**anti-BFLA**).
- Property-level checks on sensitive fields.
- Scopes are necessary but not sufficient alone for object access.

---

## 3. Quick checklist

- [ ] Authn and authz separated.
- [ ] Object-level checks on all ID paths.
- [ ] Function-level checks on privileged routes.
- [ ] Policies testable; deny by default.

See [reference.md](reference.md) and [examples.md](examples.md).