Cerbos is the open core, language-agnostic, scalable authorization solution that makes user permissions and authorization simple to implement and manage.

Cerbos Community

Question: If i have 10 users, and 15 databases, and I want to control in a very granular way which database each user can view, what's the best way to set this up as policies? I define 15 resource policies? And each of the 10 users have their own roles?

A resource kind per database or a resource kind can span several databases?

If you have 15 distinct resource kinds, then yes 15 resource policies.

Although, both resources and users may have attributes, so instead of creating a separate role and/or a separate resource kind you may use their attributes to evaluate a policy outcome. IMO this is more of a data modelling exercise.

Hmmm ok. I am facing some technical limitations with okta and am exploring the possibility of moving some of this logic to cerbos.

But you brought up a good point on whether the resource can span several databases.