Resources are FGA's references to your application's access controlled resources.
FGA stores a set of warrants representing relationships between resources in an application. These resources are typically application-specific objects persisted in the application’s datastore (e.g. MySQL, PostgreSQL, MongoDB, etc). In FGA, they are referred to as resources.
report : balance-sheet | | Resource Type Resource ID
Resources consist of three attributes:
Resources make it easier to manage the warrants associated with each resource, providing a way for applications to persist authorization-specific data outside of (or often, in lieu of) their primary datastore.
FGA automatically creates the resources that are referenced by warrants when they are created. This means developers using FGA don’t need to worry about manually creating resources.
For example, given the following warrant:
{ "resource_type": "report", "resource_id": "balance-sheet", "relation": "editor", "subject": { "resource_type": "user", "resource_id": "john-doe" } }
FGA will automatically create two resources upon creation of the warrant:
{ "resource_type": "report", "resource_id": "balance-sheet" }
{ "resource_type": "user", "resource_id": "john-doe" }
Resources can be managed from the FGA Dashboard and/or via API. Refer to the Resources API Reference to learn more about managing resources via API.
When a resource is deleted, any warrants associated with the resource will automatically be deleted. This makes it easier for applications to remove all warrants associated with a resource when the resource is deleted from the application itself.
Resources can be augmented with additional authorization-specific metadata (e.g. the display name for a role or permission, the description of a particular feature, etc). Metadata is especially useful when implementing permission-specific user interfaces. For example, when building a customer-facing page for managing team-level roles and permissions, metadata can provide user-friendly names and descriptions of what actions/resources each role or permission will grant to a user.
{ "resource_type": "user", "resource_id": "john-doe", "meta": { "email": "john-doe@acme-corp.com", "isActivated": true } }
{ "resource_type": "role", "resource_id": "accountant", "meta": { "name": "Accountant", "description": "Allows a user to view the financial reporting pages and edit charges." } }