While the Permit.io documentation includes examples of Google Drive-style permissions with ReBAC, the specific public link sharing scenario you describe isn't directly covered in the available sources. The Google Drive examples demonstrate (1) : • Direct file access where users can be viewers, commenters, or editors • Folder-level access that cascades to files within • Account admin access providing highest permissions • "General access to 'Everyone in account'" for sharing files with all account members However, these examples require authenticated users with assigned roles . The documentation shows creating users like:

await permit.api.sync_user(
    {
        "key": "<mailto:john@acme.com|john@acme.com>",
    }
)

And assigning them roles on resources:

await permit.api.role_assignments.assign(
    {
        "user": "<mailto:john@acme.com|john@acme.com>",
        "role": "viewer",
        "resource_instance": "file:2023_report",
    }
)

For audit logging, Permit.io does provide comprehensive audit logs that capture (2) : • Timestamp of attempted actions • User/machine who attempted the action • Description of the attempted action • The resource targeted • Authorization decision (Permitted or Denied) • Reasoning behind the authorization decision To implement true public link sharing with unauthenticated access while maintaining audit logs, you'd likely need to create a special "anonymous" user entity or extend the current model. The sources don't provide a specific example of this pattern. Would you like me to provide a general approach based on authorization patterns, or would you prefer to reach out to Permit.io support at Email for guidance on implementing this specific use case?

To learn more, see the sources I considered: [[1] Modeling Google Drive Permissions with ReBAC](https://docs.permit.io/modeling/google-drive) [[2] Best Practices for Authorization Audit Logs](https://www.permit.io/blog/audit-logs)

Your approach with ABAC User Sets and Resource Sets is on the right track. Let me help debug this based on the documentation. When creating User Sets (Dynamic Roles) , they need conditions that evaluate against user attributes (1) . For example:

{
  "allOf": [
    {
      "user.university": {
        "equals": "Stanford"
      }
    },
    {
      "user.is_full_time": true
    }
  ]
}

The key issue might be in how you're passing attributes during the check. According to the documentation, you need to pass user attributes in the permit.check call (2) :

const permitted = await permit.check(
  {
    key: user,
    attributes: { strongAuth: !!OTP, location },
  },
  "create",
  {
    type: "Transaction",
    attributes: { ...transaction },
    tenant,
  }
) ;

(3) For your public sharing scenario, ensure you're: 1. ​*Passing the correct attributes in the check call*​ - The "unauthenticated" user needs attributes that match your User Set conditions (1) 2. ​*Including resource attributes*​ - Your Resource Set conditions need to match attributes passed in the resource object:

const permitted = await permit.check(userKey, "read", {
  type: "file",
  attributes: {
    owners: [
      "d08c85a349994aeb89a3f02c08bdb340",
      "48fb889360604253a5189580b48694cf",
    ],
  },
}) ;

(4) 3. ​*Verifying the condition syntax*​ - Resource Set conditions should look like:

{
  "allOf": [
    {
      "resource.amount": {
        "less-than-equals": 1000
      }
    }
  ]
}

(3) To help debug further, could you share: 1. Which Workspace / Project / Env you're using 2. The exact SDK calls you're making (as code or CURL) 3. Which PDP version you're running 4. Any relevant logs from your PDP This will help identify why the permissions aren't being granted as expected.

To learn more, see the sources I considered: [[1] Building Your First ABAC Policy](https://docs.permit.io/how-to/build-policies/abac/building-abac-policy) [[2] Defining Attributes](https://docs.permit.io/how-to/build-policies/abac/defining-attributes) [[3] Fintech / Banking Demo Application](https://docs.permit.io/modeling/mesa-verde) [[4] ABAC Design Patterns](https://docs.permit.io/how-to/build-policies/abac/patterns)

@Ask Inkeep ☝️

Based on your description, the issue is likely with how resource attributes are being passed during the check. When using ABAC with Resource Sets, you need to pass the resource attributes in your permit.check call (1) . Here's how the check should look:

permitted = await permit.check(
    # User with attributes
    {
        "key": "<mailto:check@permit.io|check@permit.io>",
        "attributes": {
            "location": "England",
            "department": "Engineering",
        },
    },
    # Action
    "action",
    # Resource with attributes
    {
        "type": "resource",
        "attributes": {
            "hasApproval": "true",
        },
        "tenant": "tenant",
    }
)

For your Task resource with

privacy_status

attribute, the check should include:

permitted = await permit.check(
    # the user object
    {
        # the user key
        "key": "<mailto:check@permit.io|check@permit.io>",
        # just-in-time attributes on the user
        "attributes": {
            "location": "England",
            "department": "Engineering",
        },
    },
    # the action the user is trying to do
    "action",
    # Resource
    {
        # the type of the resource (the resource key)
        "type": "resource",
        # just-in-time attributes on the resource
        "attributes": {
            "hasApproval": "true",
        },
        # the tenant the resource belong to
        "tenant": "tenant",
    }
)

The key point is that resource attributes must be passed at check time as "just-in-time attributes" . These attributes are merged with (and override) any persisted resource attributes . To help debug this further, could you provide: 1. Which Workspace / Project / Env you're using 2. What calls you're performing (as SDK code or CURL) 3. Which PDP version you're running 4. Relevant logs from your PDP This will help our engineers investigate why the Resource Set conditions aren't being evaluated correctly.

To learn more, see the sources I considered: [[1] Running a demo](https://docs.permit.io/overview/connecting-your-app)