To create a resource set for ABAC in Permit.io, you need to define conditions based on resource attributes (1) (2) . Here's how to do it: Creating Resource Sets in the UI Navigate to the Policy screen and configure Dynamic Resources (Resource Sets) with conditions . For example, to create a resource set for "Bicycles available after 5pm" (2) :

resource.time > "17:00"

Creating Resource Sets via SDK Using the Permit.io SDK, you can create resource sets programmatically (3) (4) :

await permit.api.conditionSets.create({
  key: "departmental_hierarchy",
  name: "Departmental Hierarchy",
  type: "resourceset",
  resource_id: "Document",
  conditions: {
    allOf: [
      {
        "resource.department": {
          equals: { ref: "user.department" },
        },
      },
    ],
  },
}) ;

(3) Another example for owned resources (4) :

await permit.api.conditionSets.create({
    key: "owned_plans",
    name: "Owned Plans",
    type: "resourceset",
    resource_id: "plan",
    conditions: {
      allOf: [
        { allOf: [{ "resource.owner": { equals: { ref: "user.key" } } }] },
      ],
    },
}) ;

Resource sets group resources based on their attributes, enabling precise control over access by combining resource attributes with conditions (1) (2) .

To learn more, see the sources I considered: [[1] Create an ABAC Policy](https://docs.permit.io/overview/setup-attribute-based-access-control) [[2] Building Your First ABAC Policy](https://docs.permit.io/how-to/build-policies/abac/building-abac-policy) [[3] Implementing Serverless Authorization in Node.js with the Serverless Framework](https://www.permit.io/blog/serverless-authorization-in-nodejs-serverless-framework) [[4] From RBAC to ReBAC and ABAC with Next.js and Permit.io](https://www.permit.io/blog/from-rbac-to-rebac-and-abac-with-nextjs-and-permitio)