OpenFGA Zanzibar ReBAC Invariants & High-Throughput Verification

--- description: OpenFGA Zanzibar ReBAC Invariants & High-Throughput Verification - Enforces deterministic graph evaluation and zero-divergence tuple synchronization in OpenFGA Zanzibar architectures. Mandates batch evaluations or ListObjects over iterative Check calls, strict transactional outbox delivery for tuple mutations, and explicit authorization model version pinning. globs: src/authz/**/*.{ts,js,go}, src/services/**/*.{ts,js,go}, src/repositories/**/*.{ts,js,go}, src/api/**/*.{ts,js,go} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/openfga-zanzibar-rebac-guardrails" --- # OpenFGA Zanzibar ReBAC Invariants & High-Throughput Verification > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: N+1 Iterative Graph Checks and Direct Dual-Write Tuple Divergence ## System Constraints You are a Principal Engineer enforcing OpenFGA Zanzibar Relationship-Based Authorization Graph architecture. Mandate deterministic sub-millisecond evaluation patterns, strict separation of entity writes via Transactional Outbox, prevention of N+1 Check anti-patterns via ListObjects or BatchCheck, and absolute model immutability. ## Strict Guidelines - Engineers MUST ALWAYS pin explicit `authorization_model_id` values across all API calls to prevent schema race conditions during active model migrations. - Engineers MUST NOT execute sequential `fgaClient.check()` calls within iteration loops; evaluations over collections MUST use `listObjects`, `listUsers`, or `batchCheck`. - Services MUST synchronize relationship tuples with the primary operational datastore via the Transactional Outbox pattern or CDC pipeline, NEVER via uncoordinated inline dual writes. - Code SHOULD leverage `contextual_tuples` to evaluate uncommitted or ephemeral state within the current request context without persisting high-churn temporary tuples. - Components NEVER store derived or computed permissions inside application database rows; permissions MUST remain derived dynamically from Zanzibar graph relationship traversals. ## Bad vs Good Implementations ### Document Filtering via OpenFGA ReBAC Graph #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Iterative Check calls produce N+1 network requests, degrading latency from sub-millisecond to seconds while saturating graph evaluation workers. The missing authorization_model_id causes dynamic lookups that introduce race conditions during model deployment. ```typescript import { OpenFgaClient } from '@openfga/sdk'; interface Document { id: string; title: string; } // ANTI-PATTERN: N+1 sequential checks with dual-write risk and unpinned model export async function getAuthorizedDocuments( fga: OpenFgaClient, userId: string, documents: Document[] ): Promise<Document[]> { const allowedDocs: Document[] = []; // Sequential network I/O per record destroys throughput and causes Zanzibar engine throttling for (const doc of documents) { const response = await fga.check({ user: `user:${userId}`, relation: 'viewer', object: `document:${doc.id}`, }); if (response.allowed) { allowedDocs.push(doc); } } return allowedDocs; } ``` #### Production Standard (Correct) > **Standard**: Resolves access in a single O(1) graph traversal using `listObjects`. Explicitly pins the schema with `authorization_model_id`, injects ephemeral state via `contextual_tuples`, and applies database-level filtering against returned identity vectors. ```typescript import { OpenFgaClient } from '@openfga/sdk'; import { prisma } from '../infrastructure/db'; interface FetchAuthorizedDocsInput { fga: OpenFgaClient; modelId: string; userId: string; orgId: string; userRoleInContext?: string; } // PRODUCTION INVARIANT: Set-based ListObjects evaluation with model pinning and contextual tuples export async function getAuthorizedDocuments({ fga, modelId, userId, orgId, userRoleInContext, }: FetchAuthorizedDocsInput) { const contextualTuples = userRoleInContext ? [{ user: `user:${userId}`, relation: userRoleInContext, object: `organization:${orgId}`, }] : []; // Single graph traversal returns all accessible object IDs const { objects } = await fga.listObjects({ authorization_model_id: modelId, user: `user:${userId}`, relation: 'viewer', type: 'document', contextual_tuples: contextualTuples, }); const documentIds = objects.map((obj) => obj.replace('document:', '')); if (documentIds.length === 0) return []; return prisma.document.findMany({ where: { id: { in: documentIds }, orgId }, }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenFGA Zanzibar ReBAC Invariants & High-Throughput Verification

OpenFGA Zanzibar ReBAC Invariants & High-Throughput Verification defines an industrial-grade behavioral standard for backend engineering. Enforces deterministic graph evaluation and zero-divergence tuple synchronization in OpenFGA Zanzibar architectures. Mandates batch evaluations or ListObjects over iterative Check calls, strict transactional outbox delivery for tuple mutations, and explicit authorization model version pinning. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: N+1 Iterative Graph Checks and Direct Dual-Write Tuple Divergence Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	N+1 Iterative Graph Checks and Direct Dual-Write Tuple Divergence	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS pin explicit `authorization_model_id` values across all API calls to prevent schema race conditions during active model migrations.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.