Trusted resources

Every check targets a TrustedResource: an immutable snapshot of one resource, its ordered ancestry, and its attributes.

import { trustedResource } from "rolebook";

const project = trustedResource(
  { type: "project", id: "proj_1" },
  [
    { type: "workspace", id: "ws_456" },   // immediate parent first
    { type: "organization", id: "org_1" }, // root last
  ],
  { ownerId: "user_123", status: "draft" },
);

Ancestry

ancestors is a complete chain from immediate parent to root. Rolebook checks it against the policy’s declared parents. Scoped assignments are matched against this chain, so a workspace_editor assignment on ws_456 applies to proj_1 only because ws_456 is in the project’s ancestry.

What it proves

trustedResource() validates structure, declared ancestry, bounds, and immutability. It does not establish database provenance. An ancestor id with the right type is not proof that it is the resource’s real ancestor. Construct the chain from authoritative data, loaded by (tenantId, resourceId), never from a client-supplied path.

Attributes

Attributes are the facts conditions read under the resource. root. type and id are reserved and cannot be overridden by attributes. Keep attributes to what the policy needs; oversized structures are rejected.

Structural lookalikes

An object that merely looks like a trusted resource is rejected. Always construct resources through trustedResource() so the snapshot is owned by Rolebook.