ReBAC／認可 Graph：OpenFGA・SpiceDB

ReBAC/Authorization Graphは、relationshipに基づくpermission decisionを中央化する仕組みであり、外部identity/session revocation、source-of-truth同期、application enforcementまで自動的に保証するものではありません。OpenFGA/SpiceDBではmodel/schema、relationship data、condition/caveat context、consistency semantics、engine/datastore versionを分離して管理し、高リスクactionでは必要なfreshnessとexecution-time recheckを明示してください。validation PASSや単一のCheck結果だけをend-to-end authorization correctnessの証明にしません。

• ReBAC centralizes relationship-based authorization but does not replace identity/session revocation, resource-state validation, or application enforcement.
• Agent/model output must not be trusted as the source of principal, tenant, resource ownership, relation or condition/caveat context. Construct authorization input from authenticated/trusted application state.
• OpenFGA consistency is request-selectable. Latency-oriented checks may observe cached authorization state; high-risk post-write/revocation flows should deliberately request stronger freshness where required.
• SpiceDB exposes ZedToken-based read-your-write and exact/at-least-as-fresh semantics. Exact snapshots have GC lifetime and fully-consistent checks cost latency.
• Model/schema validation is necessary but not sufficient. Negative assertions, cross-tenant cases, revoked membership, malformed/missing condition context and migration tests are required.
• External directory/group/OAuth state must be synchronized or checked separately. A successful graph Check does not imply that an independent OAuth grant/session remains valid.
• Engine release, datastore, schema/model version and consistency mode belong in decision provenance for high-value actions.
• Recent OpenFGA security and SpiceDB changelog/issue evidence shows version-bound authorization/consistency bugs exist; pin and regression-test exact deployed releases.
• Relationship write workflows need an explicit consistency contract. Transactional outbox/reconciliation patterns can bound drift but do not make cross-system writes atomic by magic.
• Experimental features such as OpenFGA Dynamic Conditions or SpiceDB experimental planner/FDW must not be treated as stable production guarantees without version-specific acceptance.

Authorization graphのCheck結果だけで外部OAuth/session revocationやsource-of-truth同期まで証明しません。relationship write後・revocation後・高リスクactionでは、OpenFGA/SpiceDBのconsistency semanticsと外部identity/session stateを分離して扱い、必要なfreshnessとexecution-time recheckを明示します。

• “graphにtupleがあるから現在もidentity/sessionは有効” is false across composed systems.
• “write成功後の次Checkは常に最新” is unsafe without selected consistency semantics and version/datastore assumptions.
• “schema/modelがcompile/validateしたから権限設計は正しい” is false; warnings, missing negative cases and business-intent mistakes remain.
• “caveat/condition contextはAgentが生成してよい” is unsafe when that context controls authorization.
• “cacheはperformanceだけの問題” is false for authorization freshness; OpenFGA had a patched condition-cache policy-enforcement advisory.
• “current SpiceDB behavior can be inferred from old issue #2026” is false; the issue is historical/version-bound and closed.
• “fully consistent should be used everywhere” is not a universal rule; it trades latency for freshness and must match action risk/SLO.

Pre-activation fixture should include: - same-tenant allow - cross-tenant deny - unknown principal/resource deny - removed relationship/revoked membership deny - write then read under required consistency - stale/old consistency token handling - missing/false condition/caveat context - malformed context - external session revoked while tuple remains => composition layer denies - policy/model/schema version change => regression suite rerun - engine timeout/error => no execution - delayed high-risk action => recheck current relationship/session/resource state - migration/reconciliation backlog observable and bounded.

deployed OpenFGA/SpiceDB version; datastore/cache configuration; model/schema revision; identity/session authority; directory/group sync path; relationship writer; consistency contract per action class; enforcement gateway; condition/caveat context source; outbox/reconciliation; timeout/error policy; decision audit fields; rollback; upgrade procedure; semantic regression suite; tenant isolation; latency SLO.

Authorization graph IDs and relationship data can expose organizational structure; minimize logs and access. Record request ID, principal, tenant, action, resource, model/schema revision, engine version, consistency mode/token class and decision/error without secret-bearing context. Monitor tuple-sync lag, outbox backlog, deny/error/timeout rates and authorization latency. Maintain rollback for model/schema/engine upgrades.

wrong principal/tenant/resource; model-controlled context; missing enforcement path; stale tuple; delayed group sync; OAuth/session revoked but graph unchanged; latency-oriented cached allow after revoke; missing/incorrect authorization model ID; schema/model drift; condition/caveat missing context; unexpected provisional/conditional result; write succeeds but downstream source-of-truth fails or vice versa; outbox backlog; duplicate/missing tuple write handling hides upstream state error; stale ZedToken; expired exact snapshot; engine/datastore regression; upgrade migration failure; permission test lacks negative/cross-tenant fixtures; experimental feature behavior changes; permission check timeout/error converted to allow; audit record lacks model/schema/version/consistency provenance.

Current desk research using official specifications/docs, security advisory, author-maintained changelog/issues, an adopter case study and a practitioner operations report. No tenant mutation.

No live OpenFGA or SpiceDB server was started in this run. No organization directory, OAuth/session layer, tuple sync, tenant model/schema, datastore, cache, caveat/condition context, ZedToken or failure injection was tested. Practitioner/community reports are not independently reproduced. OpenFGA/SpiceDB product behavior is bounded to cited documentation/releases/issues.

ReBAC/Authorization Graphは、relationshipに基づくpermission decisionを中央化する仕組みであり、外部identity/session revocation、source-of-truth同期、application enforcementまで自動的に保証するものではありません。OpenFGA/SpiceDBではmodel/schema、relationship data、condition/caveat context、consistency semantics、engine/datastore versionを分離して管理し、高リスクactionでは必要なfreshnessとexecution-time recheckを明示してください。validation PASSや単一のCheck結果だけをend-to-end authorization correctnessの証明にしません。

Target engine/version/datastore/cache; organization model/schema; identity/session authority; directory/group sync; relationship writer/outbox; action-specific consistency SLO; tool gateway coverage; condition/caveat context source; audit retention; tenant residency; current incident exposure; exact upgrade path; organization acceptance.

Provider-neutral ReBAC control boundary、OpenFGA/SpiceDB consistency semantics、external-revocation boundary、version-bound counterevidenceとsafe wordingを分離した。tenant固有保証は主張しない。独立監査がlive pinned-engine fixtureまたはorganization model/schema testを要求する場合はSUPPLEMENT_ONLYへ戻す。