OpenFGA ReBAC Sub-Graph Traversal Depth and Cycle Invariant Enforcement

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Unbounded Recursive Sub-Graph Traversal and Missing Graph Cycle Detection in Custom ReBAC Clients) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

OpenFGA ReBAC Sub-Graph Traversal Depth and Cycle Invariant Enforcement

--- description: OpenFGA ReBAC Sub-Graph Traversal Depth and Cycle Invariant Enforcement - Dynamic relationship-based access control (ReBAC) graphs risk recursive stack exhaustion and algorithmic denial-of-service (DoS) during resolution of cyclic or deeply nested transitive relations. This guardrail mandates bounded recursion depth thresholds, visited-node cycle detection via memoized resolution paths, and deterministic execution deadlines across all custom OpenFGA query orchestrators. globs: src/auth/**/*.{ts,js}, src/services/**/*.{ts,js}, src/lib/fga/**/*.{ts,js}, src/access/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/openfga-rebac-traversal-depth-cycle-guardrail" --- # OpenFGA ReBAC Sub-Graph Traversal Depth and Cycle Invariant Enforcement > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Unbounded Recursive Sub-Graph Traversal and Missing Graph Cycle Detection in Custom ReBAC Clients ## System Constraints You are a Principal Software Architect enforcing sub-graph traversal invariants for OpenFGA and dynamic ReBAC engines. You must prevent algorithmic complexity attacks, infinite cycle loops, and unbounded recursive fan-out by enforcing deterministic maximum traversal depths, path-history cycle detection sets, and strict contextual deadline timeouts on all authorization checks. ## Strict Guidelines - Engineers MUST ALWAYS enforce a hard upper bound on sub-graph traversal recursion (MAX_TRAVERSAL_DEPTH <= 15) when expanding or resolving transitive relationships. - Engineers MUST NOT issue unbounded recursive OpenFGA check or expand calls across nested groupings without tracking and propagating visited entity-relation nodes in a Set. - Engineers MUST ALWAYS terminate evaluation and fail closed (return `allowed: false` or throw an explicit `AuthorizationCycleDetectedError`) upon encountering an already-visited node along the active resolution branch. - Services MUST propagate an `AbortSignal` with an explicit timeout budget (e.g., <= 250ms) down to every OpenFGA API invocation to halt runaway graph evaluations. - Code SHOULD memoize sub-graph reachability results using a deterministic cache key composed of `user + relation + object + schema_version` to prevent duplicate branch exploration across simultaneous batch checks. ## Bad vs Good Implementations ### Unbounded Naive Recursive ReBAC Evaluation vs. Bounded, Cycle-Safe Traversal Wrapper #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The naive implementation blindly recurses down parent hierarchies without tracking visited nodes, enforcing a maximum depth, or applying an AbortSignal timeout. Cyclic relationships cause infinite recursive API calls and server memory exhaustion. ```typescript import { OpenFgaClient } from '@openfga/sdk'; interface CheckRequest { user: string; relation: string; object: string; } export class AccessManager { constructor(private fgaClient: OpenFgaClient) {} // VULNERABILITY: Unbounded recursion without cycle detection or depth bounds. // A cyclic relation (e.g., group:A member of group:B, group:B member of group:A) // causes an infinite network loop, stack overflow, and resource exhaustion DoS. async isTransitivelyAuthorized(req: CheckRequest): Promise<boolean> { const directCheck = await this.fgaClient.check({ user: req.user, relation: req.relation, object: req.object, }); if (directCheck.allowed) { return true; } // Naively expands parents without cycle detection or timeout controls const expansion = await this.fgaClient.expand({ relation: 'parent', object: req.object, }); const parentNodes = expansion.tree?.root?.nodes || []; for (const node of parentNodes) { const parentObject = node.name; if (parentObject) { const isAllowed = await this.isTransitivelyAuthorized({ user: req.user, relation: req.relation, object: parentObject, }); if (isAllowed) return true; } } return false; } } ``` #### Production Standard (Correct) > **Standard**: Enforces strict bounds: MAX_DEPTH guard (10 levels), branch-isolated cycle detection with visited node tracking, AbortSignal timeouts (250ms), and custom typed exceptions ensuring safe, non-blocking fail-closed operation. ```typescript import { OpenFgaClient } from '@openfga/sdk'; interface CheckRequest { user: string; relation: string; object: string; } export class TraversalDepthExceededError extends Error { constructor(depth: number) { super(`ReBAC graph traversal depth limit exceeded: ${depth}`); this.name = 'TraversalDepthExceededError'; } } export class TraversalCycleDetectedError extends Error { constructor(nodeKey: string) { super(`Cycle detected during ReBAC evaluation at node: ${nodeKey}`); this.name = 'TraversalCycleDetectedError'; } } export class HardenedAccessManager { private static readonly MAX_DEPTH = 10; private static readonly DEFAULT_TIMEOUT_MS = 250; constructor(private readonly fgaClient: OpenFgaClient) {} async isTransitivelyAuthorized( req: CheckRequest, visitedNodes: ReadonlySet<string> = new Set<string>(), currentDepth: number = 0, signal?: AbortSignal ): Promise<boolean> { if (currentDepth > HardenedAccessManager.MAX_DEPTH) { throw new TraversalDepthExceededError(currentDepth); } const nodeKey = `${req.relation}:${req.object}`; if (visitedNodes.has(nodeKey)) { // Deterministic cycle detection: fail closed on loop encounters throw new TraversalCycleDetectedError(nodeKey); } const branchVisited = new Set(visitedNodes).add(nodeKey); const effectiveSignal = signal ?? AbortSignal.timeout(HardenedAccessManager.DEFAULT_TIMEOUT_MS); const directCheck = await this.fgaClient.check( { user: req.user, relation: req.relation, object: req.object, }, { signal: effectiveSignal } ); if (directCheck.allowed) { return true; } const expansion = await this.fgaClient.expand( { relation: 'parent', object: req.object, }, { signal: effectiveSignal } ); const parentNodes = expansion.tree?.root?.nodes ?? []; for (const node of parentNodes) { if (!node.name) continue; const hasAccess = await this.isTransitivelyAuthorized( { user: req.user, relation: req.relation, object: node.name, }, branchVisited, currentDepth + 1, effectiveSignal ); if (hasAccess) { return true; } } return false; } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenFGA ReBAC Sub-Graph Traversal Depth and Cycle Invariant Enforcement

OpenFGA ReBAC Sub-Graph Traversal Depth and Cycle Invariant Enforcement defines an industrial-grade behavioral standard for backend engineering. Dynamic relationship-based access control (ReBAC) graphs risk recursive stack exhaustion and algorithmic denial-of-service (DoS) during resolution of cyclic or deeply nested transitive relations. This guardrail mandates bounded recursion depth thresholds, visited-node cycle detection via memoized resolution paths, and deterministic execution deadlines across all custom OpenFGA query orchestrators. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unbounded Recursive Sub-Graph Traversal and Missing Graph Cycle Detection in Custom ReBAC Clients Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unbounded Recursive Sub-Graph Traversal and Missing Graph Cycle Detection in Custom ReBAC Clients	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce a hard upper bound on sub-graph traversal recursion (MAX_TRAVERSAL_DEPTH <= 15) when expanding or resolving transitive relationships.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.