PermissionDenied error when adding role mid-session in FaunaDB

Question

GoalValidate whether FaunaDB evaluates role permissions dynamically during a session or only at the start of a query. The test involves creating a user with a limited role, performing a forbidden operation, then adding an additional role to the same session and retrying the operation.Constraints & UncertaintiesUse test credentials to avoid accidental privilege escalation.Ensure the session is not refreshed between role changes to isolate dynamic evaluation.Current FaunaDB documentation does not explicitly state if role changes take effect mid-session.Unresolved QuestionsDoes FaunaDB re-evaluate the effective permission set each time a query is executed, allowing newly added roles to grant previously denied access?If roles can be added mid-session, what is the mechanism for updating the session’s role set without creating a new session?Are there any limits or best‑practice recommendations for dynamically altering roles during an active session?

Tasadduq Burney · Answer

AnswerFaunaDB does not re‑evaluate a session’s role set after a role is added; a query continues to run with the roles that were attached to the token used to start the transaction. Therefore adding a role mid‑session with an admin key will not retroactively grant the new permission, and the operation will still return PermissionDenied.Likely explanationEach FaunaDB transaction checks the token’s associated roles at execution time. The token is immutable for the life of the session; role changes only affect tokens created after the change.Confirmed factsFaunaDB’s ABAC model evaluates privileges against the token’s role list for every query.Modifying a role (via an admin key) does not alter existing tokens.To use a newly added role you must obtain a fresh token that includes that role.Using an admin key, create the role you need.Generate a new token that includes the role (e.g., via FaunaDB.login or CreateKey with the role).Retry the forbidden operation with this new token.If the operation still fails, verify that the token’s payload lists the expected role (inspect the JWT or use the FaunaDB dashboard).

PermissionDenied error when adding role mid-session in FaunaDB

Goal

Constraints & Uncertainties

Unresolved Questions

1 answer

Answer

Likely explanation

Confirmed facts

Your perspective belongs here.

1 question comment