Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) in Infrahub governs system access by restricting operations based on user roles and assigned permissions. The system enforces these security boundaries at the API layer to ensure all infrastructure topology mutations are authenticated and authorized before execution.

RBAC integrates directly with the Infrahub branching and temporal model, providing granular control over global resources, specific objects, and individual branches. This architecture prevents unauthorized data exposure or corruption across the organization's infrastructure topology.

Sources: dev/constitution.md:112-126, backend/AGENTS.md:73-77

Core Security Principles

Infrahub adheres to strict security standards to maintain graph integrity and prevent unauthorized access. The following principles define the RBAC implementation:

• API Layer Enforcement: The system checks authorization at the GraphQL and REST API layers before processing any request.
• Mandatory Authentication: All mutating operations require a verified user identity.
• Injection Prevention: Database queries use parameter binding (parameterized Cypher) to prevent injection attacks during authorization checks.
• Auditability: Mutations on global or default branches maintain metadata, including created_by and updated_by fields, to track user actions.

Sources: dev/constitution.md:112-126, dev/constitution.md:137-142, dev/guidelines/backend/checklist.md:52-59

Authorization Flow

The Infrahub backend processes requests through a multi-stage validation pipeline.

The diagram shows the logical flow of a request through the authentication and authorization tiers before accessing the database.
Sources: backend/AGENTS.md:73-77, dev/guidelines/backend/checklist.md:52-59

Permission Model and Checkers

The authorization architecture utilizes a specialized checker pipeline to evaluate permissions across different scopes.

Permission Scopes

Infrahub categorizes access into three primary scopes:

Sources: dev/guidelines/backend/checklist.md:52-59, backend/AGENTS.md:78-80

Checker Pipeline logic

The PermissionManager coordinates multiple checkers to determine if an actor can perform an action. You add new checkers to the pipeline by registering them within the GraphQL permission pipeline, specifying the category and denial messages.

This sequence illustrates the interaction between the API layer, the Permission Manager, and the underlying checker pipeline.
Sources: backend/AGENTS.md:73-77, backend/infrahub/permissions/manager.py

Branch and Object Permissions

Because Infrahub uses a branching model for infrastructure data, RBAC must account for branch-specific restrictions.

• Branch-Agnostic Nodes: These nodes exist across all branches. Permissions must explicitly document and test cross-branch side effects when these nodes are modified.
• Branch Status Enforcement: The system uses a BranchStatusChecker and middleware allowlists to protect branches based on their lifecycle stage (e.g., preventing writes to merged or locked branches).
• SSO and Group Mapping: The authentication flow resolves groups via SSO or LDAP, which the permission system then uses to determine role membership.

Sources: dev/constitution.md:43-52, backend/AGENTS.md:81-84, dev/guidelines/backend/checklist.md:86-93

Developer Implementation Checklist

When you plan or implement new backend features, you must address the following RBAC requirements:

1. Authentication requirements: Define if the feature requires a logged-in user or allows anonymous access.
2. Role selection: Identify which specific roles should have access to the feature.
3. Object-level restrictions: Determine if users should only access or modify resources they own.
4. Branch restrictions: Assess if branch-specific permissions are necessary for the feature's operations.
5. Custom Checkers: If object permissions are insufficient, create a new checker in backend/infrahub/permissions/checkers/.

Sources: dev/guidelines/backend/checklist.md:52-59, backend/AGENTS.md:122-125

Summary

The RBAC system in Infrahub provides a robust security framework by centralizing authorization at the API layer and utilizing a extensible checker pipeline. By integrating permissions with the branching and temporal model, Infrahub ensures that infrastructure data remains secure and consistent across different environments and user roles. Developers must ensure that all new features respect these boundaries by utilizing the established PermissionManager and adhering to the project's security constitution.