How to handle dynamic RBAC policies with domains in multi-instance B2B SaaS?

I don't know how to ask it correctly to gpt or google so here it goes:

I am trying rbac with domains. If I don't know my tenants beforehand and they signup to saas service, how would I handle policy.csv?

There are multiple services using that middleware so restarting all of them after each signup or forcing them to invalidate cache is not a good idea and probably difficult.

Is there a way to specify policy like: "Any user who has read access to that object in any domain"?

@sang6196 how do you manage updated policies if there are more than one instance of service?

I was under the impression that a csv file would be enough if I have to just check roles permission with static policies. However, the thing is we are b2b saas and our customers would like to create users in their account

Yeah same

customers can create their own roles with their own permissions

and that seems not possible with casbin for now. ?

@alexrizvi. always use DB adapter, don't use CSV in prod

Don't see why that is not possible?

The policy is hard coded in the example and as far as I can understand, casbin does not cache the change in database?

We are in microservice arch and there are instances of app that is running parallel.

So, few services fetch the updated roles, some don't

In my case only the model is static all others things are loaded from db or cache at runtime per request

and it is read on each request?

Not the most efficient but gaurantee that I get the latest data

Yeah currently not worrying about perfomance

I am not using the default structure like in this adapter:
https://github.com/casbin/xorm-adapter

So I can gather the data I need efficiently and generate the policy + role group at runtime

My example is just an example to make it understandable. In the end it will all just be id's that are matched

in my case, I am trying to understand rbac with domain.

And my domains are my client's.

They should have their own set of roles

I haven't tested database adapters yet, but does they query database on each request?

Yes I believe they do but generally you can also just load it one time and keep it in memory

This is my confusion

keep it in memory, the policy has tenant info

if there is a new signup, I add to policy and restart?

see watcher docs