This is a complex cross-tenant collaboration scenario with partial ReBAC syncing. Based on the Permit.io documentation, here's how you can approach this: Cross-Tenant Groups with ReBAC The Groups API can help manage cross-tenant collaboration (1) . Groups can contain both users and resource instances, enabling role derivation across tenants . When you assign a role to a group, the API automatically creates role derivations . For your Team:A → Team:B collaboration, you'd need to: 1. Create Team:B as a group instance in Tenant:B 2. Assign the Editor role to Team:B on Account:B1 3. Add Team:A as a member of Team:B (establishing the cross-tenant relationship) Partial Instance Syncing with Role Derivation For the partial syncing challenge where you only want to sync Accounts and Teams but still leverage derivative roles for Devices and Connections, you have a few options: Using Relationship Tuples You can sync relationship tuples to establish the parent-child relationships without syncing all instances (2) :

await permit.api.relationship_tuples.create({
  subject: "Device:B1-1",
  relation: "child_of",
  object: "Account:B1",
  tenant: "B"
}) ;

Using Resource Instance Attributes When checking permissions, you can pass the parent relationships as attributes :

await permit.check("User:A", "edit", {
  type: "Connection",
  key: "B1-1-1",
  attributes: {
    account: "B1",
    device: "B1-1"
  },
  tenant: "B"
}) ;

However, for this to work with role derivation without syncing all instances, you'll likely need custom Rego policies that can evaluate the parent relationships from the attributes passed during the check. The standard role derivation expects the instances and relationships to exist in Permit's data store. Custom Rego Approach Since you want to derive permissions based on parent relationships without syncing all instances, you'll need custom policies that can: 1. Check if the user has the Editor role on the Account (B1) 2. Derive that permission down to the Connection based on the attributes you pass The Mesa Verde example shows complex role derivation patterns (3) , but it assumes all instances are synced. For your partial sync approach, custom Rego that evaluates the parent chain from attributes would be necessary. Would you like help setting up the Groups API for cross-tenant collaboration, or would you prefer to explore custom Rego policies for the partial instance syncing?

To learn more, see the sources I considered: [[1] Groups API](https://docs.permit.io/api/rebac/groups) [[2] Sync Data into your App](https://docs.permit.io/overview/sync-applications-data) [[3] Fintech / Banking Demo Application](https://docs.permit.io/modeling/mesa-verde)

You're correct - I apologize for the confusion. Looking at the Groups API documentation more carefully, groups are created within a specific tenant context (1) . The API calls show:

curl '<https://api.permit.io/v2/schema/{project_id}/{env_id}/groups>' \
 -H 'authorization: Bearer API_SECRET_KEY' \
 --data-raw '{"group_instance_key": "marketing", "group_resource_type_key": "teams", "group_tenant": "default"}'

The

group_tenant

parameter indicates groups are tenant-scoped . When adding users or groups to a group, the operations happen within the same tenant:

curl -X PUT \
'<https://api.permit.io/v2/schema/{project_id}/{env_id}/groups/{group_resource_type_key}/users/{user_id}>' \
 -H 'authorization: Bearer API_SECRET_KEY' \
 --data-raw '{"tenant":"business"}'

For true cross-tenant collaboration without full instance syncing, you'd likely need: 1. Custom Rego policies that can evaluate cross-tenant relationships 2. A different approach using user assignments across multiple tenants (where the same user has roles in different tenants) (2) (3) 3. Or potentially modeling the collaboration at a higher level where both tenants share a common parent structure The multi-tenant RBAC model allows users to have different roles per tenant (2) , but direct group-to-group relationships across tenant boundaries aren't supported in the standard Groups API (1) .

To learn more, see the sources I considered: [[1] Groups API](https://docs.permit.io/api/rebac/groups) [[2] Best Practices for Multi-Tenant Authorization](https://www.permit.io/blog/best-practices-for-multi-tenant-authorization) [[3] FAQ | Permit.io Documentation](https://docs.permit.io/faq)

Appreciate the feedback! Feel free to ask me again with additional guidance or context.