A document collaboration product needs sharing with individuals, teams, and inherited folder permissions. Which authorization model?

The requirement is relationship-shaped

The questions this product must answer are: is this user a member of a team that has access to a folder that contains this document? and did someone share this specific document with this specific person?

That is ReBAC — relationship-based access control. The permission is derived from a graph of relationships rather than from an attribute of the user or a role they hold.

Why the alternatives fail here

RBAC cannot express it. You would need a role per document, or a role per folder, and roles would multiply with the number of resources — which is unbounded in a product where users create documents. This is role explosion in its most extreme form.

ABAC can express the individual grants but handles inheritance poorly. "Access to a folder grants access to everything transitively inside it" is a graph traversal, and attribute evaluation is not a traversal. You end up either denormalising the effective permissions onto every document — which must then be recomputed on every folder move — or performing the traversal in application code.

What the ReBAC design looks like

Relationships stored as tuples: document:report#viewer@user:alice, folder:finance#viewer@team:accounts#member, document:report#parent@folder:finance. A check walks the graph: does a path exist from this user to this document granting the required permission?

Google's Zanzibar paper is the reference design, and there are open implementations of it (SpiceDB, OpenFGA, Ory Keto).

The two properties that make it viable

Consistency of the permission check. If Alice removes Bob's access and Bob immediately reads the document, a stale check leaks data. Zanzibar's answer is a consistency token so callers can require a check no older than a known state — which matters and costs latency.

Latency at depth. Deep folder hierarchies and large team memberships make traversal expensive, so caching and precomputed reverse indexes are essential rather than optional.

The pragmatic recommendation

ReBAC for document access; keep RBAC for administrative capability — who may manage billing, configure the workspace, or view the audit log. Those are genuinely role-shaped, and mixing the models is normal rather than a compromise.

What a strong answer adds

Insisting the check is centralised as a service or library and enforced at the data layer, not implemented per endpoint. Object-level authorisation missed in one handler is a breach, and a product whose entire value is controlled sharing cannot rely on every developer remembering.