Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hi,
as far as I understood keto uses a directed graph. The Question for me is now which direction is correct?
<https://www.ory.sh/docs/keto/concepts/graph-of-relations> does not help, since  `dir1#access@user1` results in `dir1 --access--&gt; user1` and `dir1#child@(file1#)`  results in `file1 --child--&gt; dir1`

Which direction is correct?

why does the direction matter? the checks are always starting at the object#relation and search for all subjects that have that relation on the object

this is recursively repeated until the subject in question is found or all others are checked out

that's the direction from the perspective of `check`

I ask because I had a case where the defining direction mattered (at RBAC with inheritance). Therefore I'm still trying to understand why.
It was'nt working until I inverted the direction of the `parent` relation.

Ok right, we are currently reworking the docs and I think this is an important topic. I will have to check if the rewrites mess with the direction in some way. Can I ping you for a review once we have that page drafted?