Definition
Relationship-Based Access Control (ReBAC) is an authorization model based on graph-style relationships between users and resources — popularized by Google's Zanzibar and implementations like SpiceDB, OpenFGA, and Auth0 FGA.
ReBAC models authorization as a graph: "user U is a viewer of document D because U is a member of group G which has viewer permission on D." Access checks traverse the relationship graph. This is particularly natural for collaboration software where access flows through nested groups, shared folders, project membership, etc.
Zanzibar (Google's internal system) was the inspiration. Modern open-source implementations include SpiceDB (AuthZed), OpenFGA (Auth0), and Topaz. ReBAC complements RBAC + ABAC; it's especially good when authorization depends on nested relationships that change frequently.