Subject relations vs arrow operators

[jodersky]

Hi all,
I'm a bit confused with regards to the practical differences between subject relations and arrow operators. If I understand correctly, subject relations operate on the storage level (i.e. the stored tuple encodes the relationship, and the schema just declares that it is necessary), whereas the arrow operator is on the logical level (i.e. nothing is stored, the arrow is only "resolved" at runtime).

My question would be what practical differences does this actually have? And which approach is recommended?

Let's consider the following example:

1. common configuration and data:

   definition user {}
   definition group {
     relation member: user
   }
   

   test tuples:
   group:eng#member@user:alice

2. using relation tuples

   definition document {
     relation editor: group#member
     permission edit = editor
   }
   

   test tuples:
   document:doc1#editor@group:eng#member

3. using arrows

   definition document {
     relation editor: group
     permission edit = editor->member
   }
   

   test tuples:
   document:doc1#editor@group:eng

In both cases (2 and 3), the assertion document:doc1#edit@user:alice would hold, and if I understand correctly, the following operations would happen under the hood:

using relations:

1. check if user alice has edit access to document doc1
2. find groups that are are assigned to doc1 with edit relation and have member subject relation
3. for each group, check if alice is a member

using arrows:

1. check if user alice has edit access to document doc1
2. find groups that are are assigned to doc1 with edit relation
3. for each group, check if alice is a member

If that is true, then both would require the same amount of operations and thus have equivalent performance characteristics.

Maybe my question can even be further generalized: with the existence of the arrow operator, what is to be gained by having subject relations at all? I.e. why would I need to save object#relation@subject#subjectrelation in the database, when object#relation@subject along with an arrow permission can achieve the same?

Thanks

[tstirrat15]

My understanding is that they're functionally equivalent: anything that can be expressed in terms of subject relations can be expressed in terms of arrows and vice versa. The subject relation syntax came from the Zanzibar paper and we added arrows as an ergonomic handle on the same idea.

I personally prefer arrows and recommend folks choose either subject relations or arrows and stick to one approach, but I've seen places where one or the other feels more natural and folks will make exceptions.

At this point, we have both for historical reasons: we have enough people using both approaches that we don't want to deprecate either. I think this is something that we could better document. I'll add a note to the documentation repo.

[josephschorr]

Both ideas actually come from the Zanzibar paper. As you suggested, they are functionally equivalent in most cases, but there is one additional case where a subject relation works: checking for that subject directly, e.g.

check document:1234#editor@group:eng#member

This is only doable via subject relations and may be relevant contextually, where you want to know that the group's members have that role, versus the group's role being inferred.

That's really the only difference :)

[jodersky]

Thanks for your quick responses, this clears things up a lot for me!

[miparnisari]

Yes, i think this is worth documenting because i had the same question many moons ago. In my head, arrows help express "parent-of" relationships, and subject relations help express "child-of" relationships. So depending on your application's domain, one or the other might make more sense conceptually.