Dynamic Permissions about cerbos HOT 1 CLOSED

It sounds like you're trying to implement an access control list (ACL). One way to do that is to store the mapping of resource to users in your own database. Databases are optimized for set membership checks over very large sets so you can do that preliminary check first and make the result an attribute of the principal (e.g. is_in_acl). It would then become one of the conditions in your Cerbos policy (P.attr.is_in_acl == true) and you can combine that with the other context-sensitive security rules you need in addition to the simple ACL membership check (e.g. is the request being made from a trusted IP range during office hours).

from cerbos.