Multi-OrBAC for PostgreSQL
pgmorbac answers one question, can this user do this here? and enforces the answer on every row, for every client that connects. Organizations, roles and contextual rules, in plain SQL.
PostgreSQL 14+ · plain SQL, no service to run · Apache-2.0
CREATE EXTENSION pgmorbac;
-- may this nurse read patients
-- at the north clinic?
SELECT morbac.is_allowed(
'11111111-…', -- user
'clinique-nord', -- org
'read',
'patients'
);
-- t
Here is the example the documentation runs on. A nurse must read patient records at one hospital and in every department under it, but nowhere else.
That is a single pgmorbac rule. New departments are covered the day they open, and the other hospital stays invisible on its own.
INSERT INTO morbac.rules (role, activity, view, org, scope, modality)
VALUES (
'nurse', -- who
'read', -- may do what
'patients', -- on which resources
'Clinique Valmont Nord', -- where
'subtree', -- ...and everything under it
'permission'
);Simplified: real rules reference ids and a context. See the org hierarchies recipe.
The subtree scope follows the organization tree, so departments opened next year are covered with no new rule.
The southern clinic stays invisible because nothing grants it: absence of a rule is the isolation.
Attach morbac.rls_check to the table and the database filters rows itself, in every query, for every client.
Multi-OrBAC borrows roles from RBAC, attributes from ABAC and relationships from ReBAC, and puts the decision where your data already is.
Rules are scoped to a node in an organization tree. A subtree-scoped rule covers descendants automatically.
Learn more →Permissions, prohibitions, obligations and recommendations, with priorities. Ties resolve to prohibition, so it fails closed.
Learn more →morbac.rls_check drives row-level security policies, so the same decision applies to every client, including psql.
Learn more →Rules apply under SQL predicate contexts and validity windows. Delegation and temporary access expire on their own.
Learn more →Grant a role in one organization access into another, or hand a role to a colleague for a fixed window.
Learn more →morbac.is_allowed resolves roles, rules and contexts, then caches the result. One call answers everything.
Learn more →Three ways in, whichever fits how you like to start.