* Based on the available sources, Permit.io's ReBAC model supports ​*role derivation*​ through relationships, which allows permissions to flow through hierarchical structures. (1) What's Currently Supported ReBAC in Permit.io enables you to derive roles based on relationships between resources. For example, you can configure policies like: • A user who is assigned the role ​*Folder#Owner*​ will also be assigned the ​*File#Owner*​ when the ​*Folder*​ instance is the ​*Parent*​ of a ​*File*​ instance. This means permissions can be ​*implicitly granted*​ through relationship chains. The system uses a graph-based structure where relationships between resources allow for role derivations. How Role Derivations Work You can set up derivations in Permit's UI under the 'Roles' tab → 'ReBAC Options'. The Mesa Verde demo application shows examples of this pattern: • If a user is the ​*owner*​ of a ​*member*​ profile, they receive the ​*owner role*​ on related ​*medical records*​ and ​*health plan*​ instances. (2) • If a user is a ​*caregiver*​ of a ​*member*​, they receive a ​*caregiver role*​ on that member's ​*medical records*​ and ​*health plan*​. Regarding Your Specific Request The sources don't describe a specific function to directly query whether instance

A

is an ancestor of instance

B

through a chain of relations. The current documented approach focuses on ​*deriving permissions*​ through relationships rather than querying the relationship graph itself. Suggested Next Steps For this feature request, I recommend reaching out to the Permit.io team directly: • Reach out over Email Check out these potentially useful sources: • What is Relationship-Based Access Control (ReBAC) ? • Fintech / Banking Demo Application • Concepts / Glossary Would you like me to provide a general answer based on my knowledge of how such ancestor queries might be approached?

To learn more, see the sources I considered: [[1] What is Relationship-Based Access Control (ReBAC)?](https://www.permit.io/blog/what-is-rebac) [[2] Fintech / Banking Demo Application](https://docs.permit.io/modeling/mesa-verde)

Thanks for the clarification. You're asking specifically about ​*querying relationship tuples*​ to determine if a transitive/ancestor relationship exists between instances—not about permission checks or role derivations. ​*What's Currently Available*​ Permit.io allows you to create and list relationship tuples. You can filter relationship tuples using the SDK or REST API: (1)

await permit.api.relationshipTuples.list({
  tenant: "default",
  relation: "parent",
  subject: "file:file-1",
  subjectType: "file",
  object: "folder:folder-1",
  objectType: "folder",
  page: 1,
  perPage: 20,
  include_total_count: true
}) ;

Or via REST API with filters for

subject

,

object

,

relation

,

subject_type

,

object_type

, and

tenant

. (2) ​*The Limitation*​ The available sources describe how to ​*list direct relationship tuples*​ (e.g.,

A manages B

,

B manages C

) , but they ​*do not document a built-in function to query transitive/ancestor relationships*​ (e.g., "is A an ancestor of C through a chain of

manages

relations?") . The relationship tuple APIs return direct relationships only—you would need to traverse the graph yourself by querying each hop. ​*Recommendation*​ This sounds like a feature request for a transitive relationship query capability. I recommend reaching out to the Permit.io team directly: • Reach out over Email Check out these potentially useful sources: • Filter Relationship Tuples • List Relationship Tuples (Node.js SDK) Would you like a general answer on how you might implement ancestor traversal logic using the existing tuple listing APIs?

To learn more, see the sources I considered: [[1] list](https://docs.permit.io/sdk/nodejs/relationship-tuple/list-relationship-tuples) [[2] Overview](https://docs.permit.io/api/examples/filter-relationship-tuple)

Appreciate the feedback! Feel free to ask me again with additional guidance or context.