OpenFGA Contextual Tuple Graph-Depth Traversal Budget Standard

--- description: OpenFGA Contextual Tuple Graph-Depth Traversal Budget Standard - Enforces strict limits on contextual tuple injection, recursive relationship graph traversal depth, and evaluation timeouts during OpenFGA authorization checks. Prevents algorithmic denial-of-service (Graph DoS) and memory exhaustion caused by deep transitive relations or circular dynamic context. globs: src/**/auth/**/*.{ts,js}, src/**/authorization/**/*.{ts,js}, src/**/fga/**/*.{ts,js}, src/**/guards/**/*.{ts,js}, src/**/policies/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/openfga-contextual-tuple-traversal-budget-standard" --- # OpenFGA Contextual Tuple Graph-Depth Traversal Budget Standard > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Unbounded Contextual Tuples and Unconstrained Graph Traversal in OpenFGA ReBAC Evaluations ## System Constraints You are a Principal Engineer and Security Architect enforcing strict computational budgets on OpenFGA relationship-based access control (ReBAC) evaluations. Mandate deterministic bounds on contextual tuple array sizes, cycle validation on dynamic context graphs, execution timeouts, and traversal depth limits to safeguard against graph expansion DoS attacks. ## Strict Guidelines - Engineers MUST ALWAYS enforce a deterministic limit on the maximum number of contextual tuples injected per Check or ListObjects evaluation (default hard maximum: 20 tuples). - Engineers MUST ALWAYS validate dynamic contextual tuples for acyclicity and maximum nesting depth before passing them to the OpenFGA client SDK. - Engineers MUST NOT allow client-supplied or unvalidated hierarchical relationships (such as transitive group memberships or parent-child nesting) directly into contextual tuples without sanitization. - Services MUST configure explicit, bounded request timeouts (max 200ms recommended for authorization checks) and handle `FgaApiRateLimitExceededError` or graph resolution exhaustion gracefully with a default-deny posture. - Components NEVER execute unbounded batch operations (`batchCheck` or expansive `listObjects`) when contextual tuples alter deep graph relationships dynamically. ## Bad vs Good Implementations ### Bounding Contextual Tuples and Traversals in OpenFGA Client Calls #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Passing unbounded dynamic tuples into OpenFGA without size caps, cycle detection, or explicit timeouts creates a Graph Denial of Service (DoS) vulnerability. Evaluating cyclical or excessively deep transitive relationships will exhaust authorization engine memory and lock worker threads. ```typescript import { OpenFgaClient, type ClientCheckRequest } from '@openfga/sdk'; export async function authorizeUserResource( fgaClient: OpenFgaClient, userId: string, relation: string, resourceId: string, dynamicTuples: Array<{ user: string; relation: string; object: string }> ): Promise<boolean> { // Anti-Pattern: Unbounded contextual tuples passed directly from user input // No traversal timeout, no cycle detection, no size limits. // Malicious callers can submit cyclical or deep relation chains inducing high CPU/memory. const checkRequest: ClientCheckRequest = { user: `user:${userId}`, relation, object: `resource:${resourceId}`, contextualTuples: dynamicTuples }; const response = await fgaClient.check(checkRequest); return response.allowed ?? false; } ``` #### Production Standard (Correct) > **Standard**: Imposes a hard cap on contextual tuples (MAX_CONTEXTUAL_TUPLES = 20), rejects self-referential cycles prior to network invocation, configures an AbortSignal timeout to bound evaluation latency, and maintains a strict default-deny posture on error. ```typescript import { OpenFgaClient, type ClientCheckRequest, type ClientTupleKey } from '@openfga/sdk'; const MAX_CONTEXTUAL_TUPLES = 20; const CHECK_TIMEOUT_MS = 200; class ContextualBudgetExceededError extends Error { constructor(message: string) { super(message); this.name = 'ContextualBudgetExceededError'; } } function validateContextualGraph(tuples: ClientTupleKey[]): void { if (tuples.length > MAX_CONTEXTUAL_TUPLES) { throw new ContextualBudgetExceededError( `Contextual tuple budget exceeded: ${tuples.length} > ${MAX_CONTEXTUAL_TUPLES}` ); } // Detect direct self-referencing cycles before dispatching to OpenFGA for (const tuple of tuples) { if (tuple.user === tuple.object) { throw new ContextualBudgetExceededError( `Self-referential cyclical tuple detected: ${tuple.user} -> ${tuple.object}` ); } } } export async function authorizeUserResource( fgaClient: OpenFgaClient, userId: string, relation: string, resourceId: string, dynamicTuples: ClientTupleKey[] ): Promise<boolean> { validateContextualGraph(dynamicTuples); const checkRequest: ClientCheckRequest = { user: `user:${userId}`, relation, object: `resource:${resourceId}`, contextualTuples: dynamicTuples }; try { // Bounded execution budget with strict abort timeout const response = await fgaClient.check(checkRequest, { signal: AbortSignal.timeout(CHECK_TIMEOUT_MS) }); return response.allowed ?? false; } catch (error) { // Default-deny posture on timeout, cancellation, or engine budget exhaustion return false; } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenFGA Contextual Tuple Graph-Depth Traversal Budget Standard

OpenFGA Contextual Tuple Graph-Depth Traversal Budget Standard defines an industrial-grade behavioral standard for backend engineering. Enforces strict limits on contextual tuple injection, recursive relationship graph traversal depth, and evaluation timeouts during OpenFGA authorization checks. Prevents algorithmic denial-of-service (Graph DoS) and memory exhaustion caused by deep transitive relations or circular dynamic context. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unbounded Contextual Tuples and Unconstrained Graph Traversal in OpenFGA ReBAC Evaluations Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unbounded Contextual Tuples and Unconstrained Graph Traversal in OpenFGA ReBAC Evaluations	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce a deterministic limit on the maximum number of contextual tuples injected per Check or ListObjects evaluation (default hard maximum

Engineers MUST ALWAYS enforce a deterministic limit on the maximum number of contextual tuples injected per Check or ListObjects evaluation (default hard maximum: 20 tuples).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.