Access control with VCs

[its-danny]

tl;dr

I think it would be neat if we handled access control by issuing VCs to users.

The problem

As an IAM, it’s expected we have access control. We could not, and just suggest people use an existing solution, but I think there’s opportunity here to do something novel.

A proposal

I’m suggesting that we create our own access control system similar to RBAC, except that roles are issued as VCs. A neat side effect of doing it this way is that you can control access based on VCs that weren’t issued by you.

Policies could look something like this.

// Syntax

#priority (issuer, value) -> (effect, action, scope) condition

// Example

#1 ("did:acme", ("seniority", x)) -> (allow, "create", "projects") x >= args.0

// Usage

access::can(&user.did, "create", "project", (10));