Allow priority value for policies about vakt HOT 2 CLOSED

Hi @ketangoyal1988,

Current implementation assumes this logic.
The reason behind it is motivated by the fact that it's always safe to be restrictive if there is an ambiguous situation.

2 absolutely identical policies (except for their IDs) will result in the same effect (according to their effect attribute value).
2 identical policies (except for their IDs and effect) will result in the most restrictive effect of both.

Could you please elaborate more on the issue: how can it be useful, why the current implementation is inconvenient/misleading, etc.

Thanks!

from vakt.

Hi @kolotaev ,

After thinking over it, I believe the current logic would still work for my use case and is good practice. As I am new to ABAC, I was in the opinion that adding a priority might be a nice to have feature. For example, in systems having role hierarchy, a priority assignment to the policy would be helpful. Taking a simple case of an organization having mangers and employees, a user with manager role will also have employee role. If the policy for employee is restrictive for a particular resource, while access is allowed for managers, as per the current implementation the manager would still be denied access.

Thanks for the quick reply!

from vakt.