This is an automated email from the ASF dual-hosted git repository.
hsluoyz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/casbin-website.git
The following commit(s) were added to refs/heads/master by this push:
new 6313f42e5 docs: sharpen the access control model pages for search
6313f42e5 is described below
commit 6313f42e515fd8bbafd8401c3c72e790a98d167e
Author: Yang Luo <[email protected]>
AuthorDate: Tue Nov 3 17:30:47 2026 +0800
docs: sharpen the access control model pages for search
---
docs/ABAC.mdx | 7 +++++++
docs/AccessControlModels.mdx | 2 +-
docs/Biba.mdx | 18 ++++++++++++++++--
docs/LBAC.mdx | 18 ++++++++++++++++--
docs/RBAC.mdx | 7 +++++++
docs/ReBAC.mdx | 7 +++++++
docs/SuperAdmin.mdx | 22 +++++++++++++++++++---
docs/UCON.mdx | 20 +++++++++++++++++---
8 files changed, 90 insertions(+), 11 deletions(-)
diff --git a/docs/ABAC.mdx b/docs/ABAC.mdx
index 30af2f228..9e22685aa 100644
--- a/docs/ABAC.mdx
+++ b/docs/ABAC.mdx
@@ -185,3 +185,10 @@ p, r.sub.Age < 60, /data2, write
**Is ABAC the same as XACML?** No. XACML is an OASIS standard language for
writing ABAC policies. Casbin does not use XACML; rules are written in the
model's matcher or stored as policy rows.
**Can I try ABAC without writing code?** Yes. Pick an ABAC example in the
[online editor](/docs/online-editor) and edit the matcher and the request.
+
+## Related models
+
+- [RBAC](/docs/rbac)
+- [ReBAC](/docs/rebac)
+- [Policy-based access control (PBAC)](/docs/pbac)
+- [Access control models compared](/docs/access-control-models)
diff --git a/docs/AccessControlModels.mdx b/docs/AccessControlModels.mdx
index dc3adbc1d..27de91b82 100644
--- a/docs/AccessControlModels.mdx
+++ b/docs/AccessControlModels.mdx
@@ -225,4 +225,4 @@ For `design.md` (type `doc`, owner alice), alice may edit
because she is an auth
**Which libraries and platforms support both RBAC and ABAC?** Casbin supports
both, and their combination, in one model for Go, Java, Node.js, Python, .NET,
Rust and other languages. Policy engines such as [OPA](/docs/casbin-vs-opa) and
[Cedar](/docs/casbin-vs-cedar) can express both as well, while Zanzibar-style
services such as [OpenFGA](/docs/casbin-vs-openfga) are built around ReBAC.
[Casbin vs. Alternatives](/docs/comparison) compares them.
-**Does Casbin support all of these?** Yes, along with others such as
[RBAC96](/docs/rbac-96), [OrBAC](/docs/orbac), [UCON](/docs/ucon), and priority
and deny-override policies. See [Supported models](/docs/supported-models), and
try any of them in the [online editor](/docs/online-editor).
+**Does Casbin support all of these?** Yes, along with others such as
[RBAC96](/docs/rbac-96), [OrBAC](/docs/orbac), [UCON](/docs/ucon),
[LBAC](/docs/lbac), the [Biba](/docs/biba) integrity model, and priority and
deny-override policies. See [Supported models](/docs/supported-models), and try
any of them in the [online editor](/docs/online-editor). [Super
administrators](/docs/superadmin) are handled with one extra matcher condition
rather than a separate model.
diff --git a/docs/Biba.mdx b/docs/Biba.mdx
index 808c4c3fa..67ee02e51 100644
--- a/docs/Biba.mdx
+++ b/docs/Biba.mdx
@@ -1,12 +1,12 @@
---
id: biba
-title: Biba
+title: "Biba Integrity Model: No Read Down, No Write Up"
description: "Implement the Biba integrity model in Casbin - integrity levels
for subjects and objects, with no read down and no write up rules."
keywords: [biba, integrity model, security model, data integrity]
authors: [nodece]
---
-## Overview
+## What is the Biba model?
The **Biba** model (1975) enforces **integrity**: subjects and objects have
integrity levels. Rules: **no read down** (don’t read lower-integrity data),
**no write up** (don’t write to higher-integrity data). So high-integrity data
cannot be corrupted by lower-integrity sources.
@@ -97,3 +97,17 @@ Common Biba model applications:
| Read Rule | No Read Up | No Read Down |
| Write Rule | No Write Down | No Write Up |
| Phrase | "Read down, write up" | "Read up, write down" |
+
+## FAQ
+
+**What does "no read down, no write up" mean?** A subject may not read data
with a lower integrity level than its own (no read down), and may not write to
data with a higher integrity level (no write up). Both rules keep low-integrity
data from contaminating high-integrity data.
+
+**What is the difference between Biba and Bell-LaPadula?** Bell-LaPadula
protects confidentiality with "no read up, no write down"; Biba protects
integrity with the mirrored rules. The table above compares them.
+
+**Does Casbin ship a Biba model?** Casbin does not have a built-in model named
Biba. You write it as a matcher over integrity levels, as on this page; the
same approach works in any Casbin port.
+
+## Related models
+
+- [LBAC (confidentiality and integrity in one lattice)](/docs/lbac)
+- [Bell-LaPadula](/docs/blp)
+- [MAC overview](/docs/mac-overview)
diff --git a/docs/LBAC.mdx b/docs/LBAC.mdx
index a75ea8127..eec9bb28d 100644
--- a/docs/LBAC.mdx
+++ b/docs/LBAC.mdx
@@ -1,7 +1,7 @@
---
id: lbac
-title: LBAC
-description: "Implement lattice-based access control (LBAC) in Casbin,
enforcing confidentiality and integrity levels together in a single model."
+title: "What is LBAC? Lattice-Based Access Control in Casbin"
+description: "What lattice-based access control (LBAC) is, how it combines
confidentiality and integrity levels, and how to enforce both in one Casbin
model."
keywords: [lbac, lattice-based access control, security model,
confidentiality, integrity]
authors: [nodece]
---
@@ -92,3 +92,17 @@ This LBAC implementation is well-suited for:
- System administrators assign security levels
- Access decisions consider both confidentiality and integrity levels
- The model prevents information leakage and data corruption
+
+## FAQ
+
+**What is the difference between LBAC and MAC?** MAC is the category: access
is decided by system-assigned labels rather than by the resource owner. LBAC is
one way to implement MAC, using a lattice of security levels. The model on this
page puts confidentiality and integrity levels in the same lattice.
+
+**How is LBAC different from RBAC?** RBAC grants permissions to roles that
people hold; LBAC grants nothing to roles. Every request carries the subject's
and object's levels, and the matcher compares them, so there is no per-user
policy to maintain.
+
+**Can LBAC be combined with RBAC?** Yes. Keep the role checks of
[RBAC](/docs/rbac) and add the level comparisons to the same matcher; the
[access control models](/docs/access-control-models) page shows the same idea
for RBAC and ABAC.
+
+## Related models
+
+- [MAC overview](/docs/mac-overview)
+- [Bell-LaPadula (confidentiality)](/docs/blp)
+- [Biba (integrity)](/docs/biba)
diff --git a/docs/RBAC.mdx b/docs/RBAC.mdx
index 85138107e..62fcab6c6 100644
--- a/docs/RBAC.mdx
+++ b/docs/RBAC.mdx
@@ -182,3 +182,10 @@ See [RBAC with pattern](/docs/rbac-with-pattern).
## Role manager
See [Role managers](/docs/role-managers) for custom role management.
+
+## Related models
+
+- [ABAC](/docs/abac)
+- [ReBAC](/docs/rebac)
+- [Super administrator](/docs/superadmin)
+- [Access control models compared](/docs/access-control-models)
diff --git a/docs/ReBAC.mdx b/docs/ReBAC.mdx
index 6ccd8b77e..31dda32a9 100644
--- a/docs/ReBAC.mdx
+++ b/docs/ReBAC.mdx
@@ -77,3 +77,10 @@ So: the user must have the right **role on the resource**
and the resource must
**Do I need a Zanzibar-style service to use ReBAC?** No. If relationships fit
in your application's database and checks happen inside your service, a library
such as Casbin is enough. A dedicated service makes sense when many services
must share one relationship store; see [Casbin vs.
OpenFGA](/docs/casbin-vs-openfga).
**Can I try this model without writing code?** Yes. Choose the ReBAC example
in the [online editor](/docs/online-editor).
+
+## Related models
+
+- [RBAC](/docs/rbac)
+- [ABAC](/docs/abac)
+- [Access control models compared](/docs/access-control-models)
+- [Casbin vs. OpenFGA](/docs/casbin-vs-openfga)
diff --git a/docs/SuperAdmin.mdx b/docs/SuperAdmin.mdx
index 18dcf1b12..53d3270c8 100644
--- a/docs/SuperAdmin.mdx
+++ b/docs/SuperAdmin.mdx
@@ -1,11 +1,13 @@
---
id: superadmin
-title: Super Administrator
-description: The Super Admin is the administrator of the entire system. It can
be used in models such as RBAC, ABAC, and RBAC with domains.
-keywords: [Super Admin]
+title: "Super Administrator in Casbin: Bypass Policy Checks"
+description: "What a super administrator (root) is in Casbin, how to add one
to the matcher, and how the same pattern works with RBAC, ABAC and RBAC with
domains."
+keywords: [Super Admin, super administrator, root user, bypass policy]
authors: [ErikQQY]
---
+## What is a Super Admin?
+
A **Super Admin** (e.g. `root`) is a subject that bypasses normal policy and
always gets allow. You implement it in the **matcher** by adding a condition
like `r.sub == "root"`. Example:
```ini
@@ -23,3 +25,17 @@ m = r.sub == p.sub && r.obj == p.obj && r.act == p.act ||
r.sub == "root"
```
The matcher allows the request if either (1) it matches a policy rule, or (2)
`r.sub == "root"`. So `root` is never denied. The same pattern works in RBAC,
ABAC, or RBAC-with-domains: add `|| r.sub == "root"` (or your superuser name)
to the matcher.
+
+## FAQ
+
+**How do I make a super admin in Casbin?** Add `r.sub == "root"` (or your own
user name) as an alternative in the matcher, as above. The check runs before
the policy lookup, so the super admin needs no policy rows.
+
+**Is a super admin the same as an admin role?** No. An admin role is a normal
role with permissions and can be audited or removed like any other role. A
super admin bypasses the policy entirely, so keep it to one account and protect
it with MFA.
+
+**Does this work with RBAC with domains?** Yes. Append the same condition to
the matcher; it is independent of the role or domain check.
+
+## Related models
+
+- [RBAC](/docs/rbac)
+- [ABAC](/docs/abac)
+- [Access control models compared](/docs/access-control-models)
diff --git a/docs/UCON.mdx b/docs/UCON.mdx
index 83a2f76ba..1430a00f5 100644
--- a/docs/UCON.mdx
+++ b/docs/UCON.mdx
@@ -1,13 +1,13 @@
---
id: ucon
-title: Usage Control (UCON)
-description: "Usage control (UCON) with Casbin - authorizations, obligations
and conditions that are checked continuously during use, with mutable
attributes."
+title: "What is Usage Control (UCON)? Continuous Authorization"
+description: "What usage control (UCON) is: authorizations, obligations and
conditions checked continuously during use, with mutable attributes, and how to
implement it with Casbin."
keywords:
[ucon, usage control, access control, authorization, obligations, conditions]
authors: [nodece]
---
-## Overview
+## What is UCON?
**UCON (Usage Control)** extends access control with **authorizations (A)**,
**obligations (B)**, and **conditions (C)**. It supports **continuous**
enforcement during use (not only at access time) and **mutable** attributes.
Casbin does not implement UCON in the core; use the
[casbin-ucon](https://github.com/apache/casbin-ucon) extension for
session-based usage control.
@@ -166,3 +166,17 @@ func main() {
## References
For complete API documentation, detailed usage, and latest updates about
casbin-ucon, refer to [casbin-ucon](https://github.com/apache/casbin-ucon).
+
+## FAQ
+
+**Does Casbin support UCON in the core?** No. The core library makes a
decision when `Enforce()` is called. UCON needs continuous checks and mutable
attributes, so it is provided by the
[casbin-ucon](https://github.com/apache/casbin-ucon) extension, which wraps an
enforcer with sessions, conditions and obligations.
+
+**How is UCON different from RBAC?** RBAC decides once, before access, from
roles. UCON can also decide during use and after access, and its attributes can
change while a session is active, so a permission can be revoked without
waiting for the next login.
+
+**When should I use UCON?** When access depends on time, usage count, location
or other changing context, or when the policy must react while a session is
still running. If a role check at request time is enough, use
[RBAC](/docs/rbac).
+
+## Related models
+
+- [RBAC](/docs/rbac)
+- [ABAC](/docs/abac)
+- [Access control models compared](/docs/access-control-models)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
