OpenFGA Conditional Relationship Tuple Evaluation Boundary Standard

--- description: OpenFGA Conditional Relationship Tuple Evaluation Boundary Standard - Enforces strict deadline propagation, circuit breaker boundaries, and deterministic context serialization when evaluating OpenFGA conditional relationship tuples. Unbounded evaluation of dynamic ABAC conditions allows authorization bypass via resource exhaustion, request hanging, and fail-open edge-case degradation under adversarial payload loads. All check evaluations must enforce immutable context validation, strict timeouts, and fail-closed security defaults. globs: src/auth/**/*.{ts,js}, src/security/**/*.{ts,js}, src/middleware/**/*.{ts,js}, src/services/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/openfga-conditional-tuple-evaluation-boundary" --- # OpenFGA Conditional Relationship Tuple Evaluation Boundary Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Unbounded or Fail-Open OpenFGA Check Execution with Dynamic Contextual Tuples ## System Constraints You are a Principal Security Architect enforcing strictly bounded execution, fail-closed semantics, and context validation for OpenFGA conditional relationship tuples and dynamic ABAC checks. Mandate that every authorization decision carries explicit deadline timeouts, non-bypassable contextual schema checks, and defensive fallback postures to prevent Denial of Service (DoS) and authorization bypasses. ## Strict Guidelines - Engineers MUST ALWAYS pass a bounded AbortSignal or context timeout (maximum 50-100ms) to every OpenFGA check request containing contextual tuples or conditions. - Engineers MUST ALWAYS enforce strict fail-closed (access denied) behavior on client timeouts, network drops, or CEL evaluation errors from OpenFGA. - Engineers MUST validate and sanitize contextual tuple values using a deterministic runtime schema (e.g., Zod) before supplying them to OpenFGA to prevent nested payload exploitation. - Engineers MUST NOT fallback to granting access when an OpenFGA evaluation times out or encounters a 5xx/evaluation error. - Services MUST enforce circuit breakers on repeated OpenFGA timeout errors to prevent cascade exhaustion across the downstream application tier. - Components NEVER execute unbounded dynamic CEL script evaluations or deep recursive graph traversals without an explicit call-level deadline. ## Bad vs Good Implementations ### OpenFGA Check with Contextual Tuples and Timeout Enforcement #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The check lacks execution deadlines (enabling thread/socket exhaustion via complex CEL conditions), accepts arbitrary context objects without schema constraints, and dangerously fails open by returning true upon failure. ```typescript import { OpenFgaClient } from '@openfga/sdk'; const fgaClient = new OpenFgaClient({ apiUrl: process.env.FGA_API_URL, storeId: process.env.FGA_STORE_ID, }); export async function authorizeUser(userId: string, objectId: string, contextData: any): Promise<boolean> { try { // ANTI-PATTERN: No timeout, unsanitized context, and fail-open error handling const response = await fgaClient.check({ user: `user:${userId}`, relation: 'viewer', object: `document:${objectId}`, context: contextData, // Potential ReDoS / memory exhaustion payload }); return response.allowed ?? false; } catch (error) { // CRITICAL SECURITY FLAW: Failing open or treating errors as non-fatal fallback console.error('Authorization check failed, bypassing:', error); return true; } } ``` #### Production Standard (Correct) > **Standard**: Validates context data against a strict schema, implements a hard 75ms deadline via AbortController, and strictly fails closed by returning false on any evaluation failure or timeout. ```typescript import { OpenFgaClient, ClientCheckRequest } from '@openfga/sdk'; import { z } from 'zod'; const fgaClient = new OpenFgaClient({ apiUrl: process.env.FGA_API_URL!, storeId: process.env.FGA_STORE_ID!, }); const ContextSchema = z.object({ current_time: z.string().datetime(), ip_address: z.string().ip(), device_risk_score: z.number().min(0).max(100), }).strict(); export type DynamicContext = z.infer<typeof ContextSchema>; const EVALUATION_TIMEOUT_MS = 75; export async function authorizeUser( userId: string, objectId: string, rawContext: unknown ): Promise<boolean> { // 1. Validate contextual boundary prior to FGA dispatch const parseResult = ContextSchema.safeParse(rawContext); if (!parseResult.success) { return false; // Fail-closed on invalid ABAC context } const controller = new AbortController(); const timeoutId = setTimeout(() => controller.abort(), EVALUATION_TIMEOUT_MS); try { const payload: ClientCheckRequest = { user: `user:${userId}`, relation: 'viewer', object: `document:${objectId}`, context: parseResult.data, }; const response = await fgaClient.check(payload, { signal: controller.signal, }); return Boolean(response.allowed); } catch (error: unknown) { // Fail-closed invariant: Timeouts, aborts, and 5xx errors deny access return false; } finally { clearTimeout(timeoutId); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenFGA Conditional Relationship Tuple Evaluation Boundary Standard

OpenFGA Conditional Relationship Tuple Evaluation Boundary Standard defines an industrial-grade behavioral standard for security engineering. Enforces strict deadline propagation, circuit breaker boundaries, and deterministic context serialization when evaluating OpenFGA conditional relationship tuples. Unbounded evaluation of dynamic ABAC conditions allows authorization bypass via resource exhaustion, request hanging, and fail-open edge-case degradation under adversarial payload loads. All check evaluations must enforce immutable context validation, strict timeouts, and fail-closed security defaults. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unbounded or Fail-Open OpenFGA Check Execution with Dynamic Contextual Tuples Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unbounded or Fail-Open OpenFGA Check Execution with Dynamic Contextual Tuples	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS pass a bounded AbortSignal or context timeout (maximum 50-100ms) to every OpenFGA check request containing contextual tuples or conditions.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.