Implement cross-domain role inheritance: g, admin, developer, domain1, domain2

[](https://issuehunt.io/r/casbin/casbin/issues/493)

Hi there,

I'm building an RBAC system with domains. There are some constraints: Users are admins associated with permissions in an organization. Each organization can have multiple partner organizations. Once a partnership is established, admin users in both organizations will need to have permission to access the resources of the partner organization. The desired behaviour is to give permissions to existing admin users in `orgA` to access the child `orgB` domain.

For example, let's say Alice and Eve have `super_admin` roles in `orgA`. `OrgB` is a sub-organization of `orgA`. In this scenario, how can I give `developer` role to Alice and Eve to access `orgB` data in the most efficient way?

```csv
p, role::admin, data1, read
p, role::developer, data1, write

g, role::super_admin, role::developer, *
g, role::super_admin, role::admin, *

g, alice, role::super_admin, domain::orgA
g, eve, role::super_admin, domain::orgA
g, bob, role::super_admin, domain::orgB
g, chris, role::admin, domain::orgB
```

I'm trying not to introduce new rules explicitly for Alice and Eve. Because if orgA has dozens of admins and sub-organizations then it'll cause an overhead to assign new permission to each admin for each child organization. Also if any of the admins decide to delete their account, it'll be an expensive operation to clean up all policy entries for those users. So I'm trying to minimize user to policy mapping in casbin rules database.

---

IssueHunt Summary

### Backers (Total: $0.00)

#### [Become a backer now!](https://issuehunt.io/r/casbin/casbin/issues/493)
#### [Or submit a pull request to get the deposits!](https://issuehunt.io/r/casbin/casbin/issues/493)
### Tips

- Checkout the [Issuehunt explorer](https://issuehunt.io/r/casbin/casbin/) to discover more funded issues.
- Need some help from other developers? [Add your repositories](https://issuehunt.io/r/new) on IssueHunt to raise funds.