It looks like you're asking about ​*Permify*​, which is a different authorization product. I'm an AI assistant for ​*Permit.io*​, so I can only help with Permit.io-related questions. That said, the ancestor/transitive relationship query you're describing is a core capability of *Relationship-Based Access Control (ReBAC) *, which Permit.io supports natively. How Permit.io Handles This In Permit.io's ReBAC model, you can define ​*role derivations*​ that automatically propagate permissions through relationship hierarchies. (1) For your example (A manages B, B manages C → A is an ancestor of C) , you would: 1. ​*Define resource relationships*​ between entities (e.g.,

manager

relation) 2. ​*Set up role derivations*​ so that roles propagate through the relationship graph , (2) 3. ​*Query permissions*​ using

permit.check()

, which evaluates the full relationship graph to determine access (3) Permit.io uses a graph-based approach where the

graph.reachable()

function (in the underlying OPA engine) traverses relationships to determine if a user can reach a resource through any path in the hierarchy. If You're Interested in Permit.io If you'd like to explore how Permit.io can handle your use case, I'd recommend: • What is ReBAC? • ReBAC with OPA For feature requests specific to Permify, you would need to contact their team directly.

To learn more, see the sources I considered: [[1] What is Relationship-Based Access Control (ReBAC)?](https://www.permit.io/blog/what-is-rebac) [[2] Fine-Grained Keycloak Authorization with ABAC and ReBAC](https://www.permit.io/blog/fine-grained-keycloak-authorization-with-abac-and-rebac) [[3] How to Implement Relationship-Based Access Control (ReBAC) Using Open Policy Agent (OPA)](https://www.permit.io/blog/relationship-based-access-control-rebac-with-open-policy-agent-opa)