FaunaDB RBAC: Transitioning from Secret Keys to Role-Based Access Control

Managing RBAC Hierarchies and Conflicts

To ensure no unintended public access exists in a deeply nested FaunaDB RBAC hierarchy, the recommended strategy is to implement a deny-by-default audit. Because FaunaDB does not provide a built-in "permission simulator" for complex nested roles, auditing requires a systematic verification of the least-privileged token.

Auditing Strategy for Nested Hierarchies

To prevent accidental public exposure, follow these verification steps:

• Isolate the Public Role: Specifically audit the role assigned to client-side or unauthenticated tokens. Ensure this role has zero permissions on sensitive collections.
• Negative Testing: Create a test token for each role and attempt to perform a Get or Update operation on a collection that should be restricted. A 403 Forbidden response confirms the boundary is intact.
• Schema Mapping: Document the mapping of Roles to Collections in an external matrix. Since permissions are additive, this allows you to spot overlapping scopes that the dashboard UI may obscure.

Handling Permission Conflicts

FaunaDB handles overlapping scopes through additive permissioning. If a token is associated with multiple roles, the system grants the union of all permissions provided by those roles.

Example Scenario:

Role A	Role B	Resulting Access
Read-Only (Collection X)	Write-Only (Collection X)	Read and Write (Collection X)
Read (Collection Y)	No Access (Collection Y)	Read (Collection Y)

Because there is no "explicit deny" that overrides an "allow," a conflict is resolved in favor of the most permissive role. To restrict access, you must remove the permissive role from the token rather than attempting to block it with a more restrictive role.

Verification Command

To verify that a specific token is restricted as intended, use a scoped request via the Fauna Shell or API. If the following returns a permission error, the RBAC boundary is functioning:

// Attempt to read a restricted collection using a limited role token
Get(Collection('restricted_data'))

Missing Diagnostic: Are you utilizing Attribute-Based Access Control (ABAC) within your roles (e.g., using Match to restrict documents to a specific user_id)? This significantly changes the auditing process from collection-level checks to document-level logic verification.