Most business software still handles permissions using traditional Role-Based Access Control (RBAC).
The idea is simple:
You are an HR Manager → you get HR Manager permissions.
This works well until the organization becomes more complex.
What if someone should manage employees only in their department? What if a Team Lead should see compensation for their team, but not another team? What if Finance needs access to compensation across several specific teams without becoming a global administrator?
With static RBAC, this usually means more roles, more permission combinations, and eventually a lot of complexity.
At X-HR, we took a different approach: Relationship-Based Access Control (ReBAC).
Permissions based on relationships
Instead of asking only:
“What role does this person have?”
ReBAC can also ask:
“What is this person's relationship to this resource?”
For example:
Sarah is Department Lead → Engineering
John is Team Lead → Platform Team
Anna is Department HR → Sales
David is Member → Platform Team
From those relationships, X-HR can dynamically determine what each person can access.
A Team Lead might be allowed to view employee information for members of their own team. A Department Lead can have broader visibility across teams within their department. Department HR can manage HR-related information for employees in that department.
The same principle can extend across employee data, documents, compensation, attendance, time off, payroll, requests, and other X-HR apps.
Your organization structure becomes part of access control
This is where ReBAC becomes particularly powerful.
In X-HR, companies can choose a simple Flat Structure with Admin, HR Manager and Employee roles.
As the company grows, they can move to a Team & Department structure and introduce relationships such as Team Lead, Team Member, Department Lead, Department HR and Department Member.
And these structures don't need to be hardcoded into every application.
Because permissions are driven by relationships, organizations can build much more dynamic structures on the fly.
The permission configuration can then express rules such as:
Compensation → View → Department Lead
or:
Employee Profile → View → Team Lead
The relationship determines which employees that permission applies to.
Why this matters
Traditional RBAC tends to become harder to maintain as organizations grow because every new organizational scenario can require another role or another special permission.
ReBAC lets the access model follow the organization instead.
People change teams. Managers change. Departments split. Cross-functional groups appear.
The relationships change - and access can change with them.
For us, ReBAC isn't just a security feature.
It's one of the foundations that allows X-HR to be a truly configurable HR platform that can grow with the organization.
