Modelling Access Permissions in a Cloud-Based Collaboration Platform

The objective of this case study is to demonstrate how relations, equivalence classes, and closures can be applied to design and manage access permissions in a cloud-based collaboration platform (e.g., Google Drive, Microsoft OneDrive, or Dropbox).

The scenario is that a company uses a cloud-based platform to manage documents and projects. Employees are assigned to teams, and each team has access to specific folders. The system must enforce the following rules:

1. Every employee belongs to exactly one team.
2. Employees in the same team have the same access permissions.
3. If an employee has access to a folder, and that folder is shared with another folder, the employee should also have access to the shared folder.
4. The system must be able to determine whether two employees have equivalent access rights.

Define the following:

• • [latex]E[/latex] be the set of employees
  • [latex]T[/latex] be the set of teams
  • [latex]F[/latex] be the set of folders
  • [latex]R_{1} \subseteq E \times T[/latex] be the relation “employee belongs to team”
  • [latex]R_{2} \subseteq T \times F[/latex] be the relation “team has access to folder”
  • [latex]R_{3} \subseteq F \times F[/latex] be the relation “folder is shared with another folder”
  • [latex]R_{4} = R_{2} \circ R_{1}[/latex]: the composition of [latex]R_{1}[/latex] and [latex]R_{2}[/latex] gives the relation “employee has access to folder”
  • [latex]R_{3}^{+}[/latex]: the transitive closure of [latex]R_{3}[/latex], representing all folders reachable through sharing

Task 1

Let [latex]E[/latex] = {Aiden, Benjamin, Chloe, Daniel}, [latex]T[/latex] = {Team1, Team2}, and [latex]F[/latex] = {FolderA, FolderB, FolderC}. Define the relations [latex]R_{1}[/latex], [latex]R_{2}[/latex], and [latex]R_{3}[/latex] using the following information:

• Aiden and Benjamin belong to Team 1, and Chloe and Daniel belong to Team 2.
• Team 1 has access to Folder A and Team 2 has access to Folder B.
• Folder A is shared with Folder C, and Folder C is shared with Folder B.

Task 2

Compute [latex]R_{4}[/latex] and [latex]R_{3}^{+}[/latex] and then update access using [latex]R_{4}[/latex] and [latex]R_{3}^{+}[/latex].

Task 3a

Define a relation [latex]R_{5}[/latex] on [latex]E[/latex] such that [latex](e_{1}, e_{2}) \in R_{5}[/latex] if and only if [latex]e_{1}[/latex] and [latex]e_{2}[/latex] have access to the same set of folders.

Task 3b

Check the employees’ folder access and which pairs are in the relation [latex]R_{5}[/latex].

Task 3c

Prove that [latex]R_{5}[/latex] is an equivalence relation.

Task 4

Determine the equivalence classes induced by [latex]R_{5}[/latex]. These partitions help the system group users with identical access rights for efficient permission management.