Hi, there.
I am implementing a hierarchical access control system with role overrides for specific entities in my application. The structure is based on inherited roles across a hierarchy of three entities: ENTITY 1 -> parent of ENTITY 2 -> parent of ENTITY 3. I’ve already implemented an RBAC model that works correctly. However, I now need the policies to be validated only up to the point where a direct role is assigned to an entity.
For example, when checking permissions from the lowest-level entity, the system should move up the hierarchy until it finds an entity with directly assigned roles. This way, if a user has the editor role in ENTITY 1 but the reader role in ENTITY 2, they won’t have editor permissions throughout the system. Instead, in ENTITY 2 and ENTITY 3, only the reader role would apply.
Does anyone know how I can implement this? Is there an official way to handle it?
