Relationship-based authorization is an access control model that decides permissions from links between users, resources, and roles. Instead of checking only a static role name, the system asks whether a user is connected to an object through an allowed relationship, such as owner, member, editor, or delegate. This approach is common in fine-grained authorization systems because it can represent real business rules more naturally than simple role-based access control.
In cyber security, this matters because relationships are often the real source of access in cloud apps, SaaS platforms, and multi-tenant services. Attackers may try to exploit stale group membership, over-broad sharing rules, or broken relationship checks to reach data they should not see. Defenders use relationship graphs, policy engines, and audit logs to keep permissions consistent, test changes safely, and remove unintended access. When designed well, this model supports scalable least privilege without hardcoding authorization logic into every application path.