Is it possible to remove or negate a permission or capability from a user that was part of role

[lakshmaji-till]

1. Ive created custom roles and storing them my system database
2. Then i've mapped capabilities or permissions to the custom roles created above using OpenFGA tuples
3. Then assigning users to custom roles w.r.t locations.

This is working as expected. Let say I have a role External Team and which have can_invite_user and can_delete_user capabilities. And I assigned the External Team to users lakshmaji and gru. But I want to remove can_delete_user capability to lakshmaji only.

I saw Blocklists guide. Is the Blocklists approach really scalable with custom roles ?
It there a better approach to do permission override ?

Somewhat similar threads ive followed

1. https://github.com/orgs/openfga/discussions/377

Here is OpenFGA authorization model

model: |
  model
      schema 1.2

  type user

  type role
      relations
          define assignee: [user] 

  type organization
      relations
          # Organizations can have predefined ones, in addition of dynamic roles
          # that can be defined by each organization 
          define owner: [user]

          # These roles can be assigned to a dynamic role, and all admins inherit it too.
          define user_manager: [role#assignee] or owner
          define location_manager: [role#assignee] or owner
          define location_viewer: [role#assignee] or owner
          define billing_manager: [role#assignee] or owner
          
          define can_invite_user: [role#assignee] or user_manager
          define can_delete_user: user_manager
          define can_edit_billing: billing_manager
          define can_create_location: location_manager

  type location
      relations
          # A organiation can have multiple locations
          define parent: [organization]

          # Direct user assignments to locations (for location-scoped permissions)
          define manager: [user]
          define staff: [user]

          # Location permissions come from direct user assignments only (not org-wide roles)
          define editor: manager
          define viewer: staff

          define can_view: viewer or editor
          define can_edit: editor
          define can_delete: editor

[rhamzeh]

In general, there are several ways to go about this, but considering your use-caseit looks as if denying users is not the norm and usually the exception, so the below would work well.

TLDR: add a but not on can_delete_user

          define user_manager: [role#assignee] or owner
          define blocked_from_critical_tasks: [user]
          
          define can_invite_user: [role#assignee] or user_manager
          define can_delete_user: user_manager but not blocked_from_critical_tasks

Now if this is the norm, and not an exception, you may want to do something like:

          define user_admin: [role#assignee] or owner
          define user_manager: [role#assignee] or user_admin
          
          define can_invite_user: [role#assignee] or user_manager
          define can_delete_user: user_admin

[lakshmaji-till]

Thank you @rhamzeh for the detailed response 🙏.

Since roles in my system are custom-defined and stored in our DB, I’m concerned that the but not approach won’t scale well in practice. The reason is that permission overrides are a common requirement for us at the user level.

In our setup:

A user inherits all capabilities from the custom role they’re assigned.

At the individual user level, we may need to grant additional permissions or remove certain permissions.

This means we’d end up needing quite a few exceptions, and maintaining a growing list of blocked_from_* style relations could get unwieldy.

Do you think there’s a cleaner pattern (e.g., modeling overrides as a first-class concept) that fits better with user-level additions/removals of permissions?