Every system starts with roles: Customer, Advisor, Admin. Then the real world walks in. A customer may see their own accounts, and those of the minor child they hold a mandate for. An advisor sees their portfolio, until a colleague takes over during a vacation. A large payment needs a second pair of eyes, but not the eyes of the person who created it. Suddenly your role table has 4,000 rows and your if statements read like a hostage note.

In this session we replace that mess with relationship-based access control, the Zanzibar model behind Google's authorization, using OpenFGA. We use this to authorize users of a banking API built with ASP.NET Core. Authorization becomes a question you ask ("may this user do this to that object?") instead of logic you scatter across services.

Along the way we handle the hard parts: four-eyes approvals, time-limited mandates, listing "everything I may see" without N+1 checks, keeping relationship data in sync, testing your access rules in CI, and migrating from roles without a big bang.

You'll leave with a working reference model, a migration plan and a healthy respect for the question "who may do what?"