Resources

What is a Resource?

A resource represents an entity in your application that you want to protect with permissions. Documents, projects, users, reports, jobs—anything that subjects need permission to access is a resource.

Resource Types

Define categories of resources

Resource Hierarchies

Model parent-child resource relationships

Resource Scope Links

Share resources across scopes

Resource Collections

Dynamic resource grouping with match rules

Resource Policies

Fine-grained allow/deny on resources

Resource Properties

Property	Type	Description
`id`	`string`	Unique Bedrock identifier
`resourceTypeId`	`string`	Reference to the resource type
`ownerScopeId`	`string`	The scope that owns this resource
`externalResourceId`	`string`	Your system’s identifier
`displayName`	`string?`	Human-readable name
`createdAt`	`string`	Creation timestamp
`createdBy`	`string`	Subject who created it

Creating Resources

# First, create a resource type
curl -X POST 'https://api.example.com/resource-types' \
  -d '{
    "name": "Document",
    "key": "document",
    "scopeId": "scope_org"
  }'

# Then create resource instances
curl -X POST 'https://api.example.com/resources' \
  -d '{
    "resourceTypeId": "rtype_document",
    "ownerScopeId": "scope_engineering",
    "externalResourceId": "doc-123",
    "displayName": "Q4 Planning Doc"
  }'

Resource-Based Permissions

Permissions can target specific resources or resource patterns:

# Permission for all documents
curl -X POST 'https://api.example.com/permissions' \
  -d '{
    "scopeId": "scope_org",
    "action": "read",
    "resourceType": "document",
    "resourcePattern": "*",
    "key": "document:read:*"
  }'

# Permission for a specific document
curl -X POST 'https://api.example.com/permissions' \
  -d '{
    "scopeId": "scope_org",
    "action": "read",
    "resourceType": "document",
    "resourcePattern": "doc-123",
    "key": "document:read:doc-123"
  }'

Evaluating Against Resources

When checking permissions, you can specify the resource:

const decision = await bedrock.evaluate({
  actor: { subjectId: "subject_jane", subjectType: "user" },
  scopeId: "scope_engineering",
  action: "read",
  resource: {
    resourceId: "resource_doc_123",
    // OR
    externalResourceId: "doc-123",
    resourceType: "document"
  }
});

Resource Ownership

A resource’s ownerScopeId is the scope that owns it (it also serves as the always-reachable scope for the reachability gate—see Resource Scope Links). It is a scope, not a subject.

curl -X POST 'https://api.example.com/resources' \
  -d '{
    "resourceTypeId": "rtype_document",
    "ownerScopeId": "scope_engineering",
    "externalResourceId": "doc-456",
    "displayName": "Engineering Handbook"
  }'

To make a subject an owner of a resource—so the engine grants that subject an owner role’s permissions on it—use a resource-ownership grant (owns(subject, resource, role)), which the engine evaluates as its own leg. That is distinct from ownerScopeId.

Common Patterns

Pattern 1: Document Management

# Resource types
curl -X POST 'https://api.example.com/resource-types/batch' \
  -d '[
    {"name": "Folder", "key": "folder", "scopeId": "scope_org"},
    {"name": "Document", "key": "document", "scopeId": "scope_org"},
    {"name": "Comment", "key": "comment", "scopeId": "scope_org"}
  ]'

Pattern 2: Project Management

curl -X POST 'https://api.example.com/resource-types/batch' \
  -d '[
    {"name": "Project", "key": "project", "scopeId": "scope_org"},
    {"name": "Task", "key": "task", "scopeId": "scope_org"},
    {"name": "Milestone", "key": "milestone", "scopeId": "scope_org"}
  ]'

Pattern 3: E-Commerce

curl -X POST 'https://api.example.com/resource-types/batch' \
  -d '[
    {"name": "Product", "key": "product", "scopeId": "scope_org"},
    {"name": "Order", "key": "order", "scopeId": "scope_org"},
    {"name": "Customer", "key": "customer", "scopeId": "scope_org"}
  ]'

API Reference

Create Resource Type

Define a new resource type

Create Resource

Create a resource instance

Get Resources

List resources

Resource Types API

All resource type operations

Next Steps

Resource Types

Learn how to define resource type schemas

Getting Started

Core Concepts

Tags

Delegation

Use Cases

Modeling Guides

Resources

What is a Resource?

Resource Types

Resource Hierarchies

Resource Scope Links

Resource Collections

Resource Policies

Tags

Resource Properties

Creating Resources

Resource-Based Permissions

Evaluating Against Resources

Resource Ownership

Common Patterns

Pattern 1: Document Management

Pattern 2: Project Management

Pattern 3: E-Commerce

API Reference

Create Resource Type

Create Resource

Get Resources

Resource Types API

Next Steps

Resource Types

​What is a Resource?

Resource Types

Resource Hierarchies

Resource Scope Links

Resource Collections

Resource Policies

Tags

​Resource Properties

​Creating Resources

​Resource-Based Permissions

​Evaluating Against Resources

​Resource Ownership

​Common Patterns

​Pattern 1: Document Management

​Pattern 2: Project Management

​Pattern 3: E-Commerce

​API Reference

Create Resource Type

Create Resource

Get Resources

Resource Types API

​Next Steps

Resource Types

What is a Resource?

Resource Properties

Creating Resources

Resource-Based Permissions

Evaluating Against Resources

Resource Ownership

Common Patterns

Pattern 1: Document Management

Pattern 2: Project Management

Pattern 3: E-Commerce

API Reference

Next Steps