Artificial Intelligence (AI) has created an inexplicable shift in the tech sector in the last few years. Some see the presence of AI as an invasion of the thinking man, while others see it as the savior of humanity. We meet in the middle and proclaim it as a means to an end.
Let’s face it: AI has proved itself good in many things, simplifying mundane tasks to a few words, all in natural language. Access control remains one of those mundane areas of programming as it is repetitive and can sometimes seem uninteresting. Traditional role-based access control usually requires constant human intervention, making it tedious for growing organizations.
With a more context-aware mode of access control, such as Attribute-Based Access Control (ABAC), you can define permissions within AI-integrated applications and not worry about any issues with your data. ABAC allows you to enforce policies based on multiple contextual factors such as users’ employment status and role, their department, etc.
This article will show how you can create a project management tool that uses an AI to create projects while ABAC enforces permissions that safeguard your resources. We will make a web application using Next.js with Deepseek R1 as the LLM and <a href="http://Permit.io" target="_blank" rel="noopener nofollow">Permit.io</a> to implement granular access control on resource objects.
<h2>Prerequisites</h2>
To follow this article, you must have:
<ul>
<li>An <a href="https://appwrite.io/" target="_blank" rel="noopener nofollow">Appwrite</a> account</li>
<li>A <a href="https://platform.deepseek.com/" target="_blank" rel="noopener nofollow">Deepseek platform</a> account API Key. You must ensure your account is topped up to use Deepseek’s API key.</li>
<li>A <a href="http://Permit.io" target="_blank" rel="noopener nofollow">Permit.io</a> account.</li>
</ul>
<h2>Setting up Appwrite</h2>
Appwrite is a self-hosted Backend-as-a-Service (BaaS) for web, mobile, native, or backend apps. It is completely tooled with features like database, authentication, cloud functions, etc. Saving you the hassle of building a backend from scratch. In this article, we utilize Appwrite for authentication and database storage. To set up Appwrite, you will need to:
Step 1: Log into your <a href="http://Appwrite.io" target="_blank" rel="noopener nofollow">Appwrite.io</a> account and Create a project called Project Manager. You can provide a personalized ID, or Appwrite will auto-generate one.
<img src="https://hackmd.io/_uploads/Hyuk3cc_Jl.png" alt="create-project-2">
Step 2: After, go to Overview → Settings. There, you will find your Appwrite Project ID and API endpoint. Copy them to a safe place, as you will need them for your web application.
<img src="https://hackmd.io/_uploads/B1dRtrQTJx.png" alt="Screenshot 2025-03-27 at 22.55.46">
Step 3: Return to the Overview section and add a web platform. Give it a name: project manager app and set the hostname localhost since you are using a local environment now.
<img src="https://hackmd.io/_uploads/B1zSR95_kl.png" alt="add platform">
<img src="https://hackmd.io/_uploads/r1AdR9cO1e.png" alt="hostname registration">
Step 4: Click on Databases in the sidebar and create a new database called project_management_database. Ensure you copy the database ID to a safe place to use later.
<img src="https://hackmd.io/_uploads/rJF_SNRu1g.png" alt="create databases">
<img src="https://hackmd.io/_uploads/SynE0H7a1l.png" alt="Screenshot 2025-03-27 at 23.06.13">
Step 5: After, create a collection within this database and call it Projects. This collection will contain all the Projects created for our project management tool.
<img src="https://hackmd.io/_uploads/SJvn0H7TJx.png" alt="create collection (1)">
<img src="https://hackmd.io/_uploads/Ski21LmpJe.png" alt="Screenshot 2025-03-27 at 23.19.03">
<blockquote>
Note: Copy the collection ID, as it is essential to build the web application.
</blockquote>
For the Projects collection, add the four attributes below by going to the Attributes section within the collection:
<ul>
<li>title (string, 100, required)</li>
<li>department (string, 100, required)</li>
<li>sensitivity_level (string, 50, required)</li>
<li>status (enum, [“Archived”, “In Progress”, “Completed”], Default value: “In Progress”)</li>
</ul>
<img src="https://hackmd.io/_uploads/ryJ-xIX61g.png" alt="Screenshot 2025-03-27 at 23.23.08">
Navigate to the Settings tab within the collection and scroll to the Permissions section. Next, click Add role and select All users. Also, check all the CRUD permission boxes and toggle on Document security in the Document security section.
<img src="https://hackmd.io/_uploads/HJhte8mpkx.png" alt="Screenshot 2025-03-27 at 23.25.13">
<h2>Setting Up the Project Management Application</h2>
There is already a starter template for the application so that we will focus on the core functionalities. We will clone the GitHub repository as well as initialize the dependencies from the <code>package.json</code> file using the command below:
<pre><code class="language-bash">git clone https://github.com/muyiwexy/project-manager.git
cd project-manager
npm install
</code></pre>
After you have done that, create a local environment file in the root of your project called <code>.env.local</code> and paste the variables below:
<pre><code class="language-javascript">NEXT_PUBLIC_APPWRITE_ENDPOINT=https://cloud.appwrite.io/v1
NEXT_PUBLIC_APPWRITE_PROJECT_ID=&lt;Paste your appwrite project id&gt;
NEXT_PUBLIC_APPWRITE_DATABASE_ID=&lt;Paste your database id&gt;
NEXT_PUBLIC_APPWRITE_PROJECT_COLLECTION_ID=&lt;Paste your project collection id&gt;
</code></pre>
These variables contain values of the ID and endpoint gotten or generated when setting up your Appwrite project.
Once you have done that, run <code>npm run dev</code>, and you should have the home like the image below:
<img src="https://hackmd.io/_uploads/Sy93S14TJl.png" alt="Screenshot 2025-03-28 at 10.01.48">
We are getting an error when fetching projects because the API endpoints responsible for that do not exist. We will get into that in the coming sections, but first, let’s set up our project resource on <a href="http://Permit.io" target="_blank" rel="noopener nofollow">Permit.io</a> and define ABAC policies that will control access to our database resource.
<h2>Setting up a <a href="http://Permit.io" target="_blank" rel="noopener nofollow">Permit.io</a> Project</h2>
<a href="http://Permit.io" target="_blank" rel="noopener nofollow">Permit.io</a> provides an API key to connect your project to their services using a node SDK. To do that, you must follow these steps:
<ul>
<li>Create a <a href="https://app.permit.io/" target="_blank" rel="noopener nofollow">Permit.io</a> account if you have not done that already.</li>
<li><a href="http://Permit.io" target="_blank" rel="noopener nofollow">Permit.io</a> automatically creates a new project for you as a new user. You can check it out in the Projects tab.
<img src="https://hackmd.io/_uploads/BkfLRRU21e.png" alt="Screenshot 2025-03-18 at 12.51.32"></li>
<li>Within the Projects tab, you will see two environments: Production and Development. Select the environment you are building for and copy the API key from the environment.
<img src="https://hackmd.io/_uploads/HkCTA0Unyx.png" alt="Screenshot 2025-03-18 at 12.52.00"></li>
</ul>
Once you have the API key, you will need a PDP (Policy-Decision-Point) URL, and we will show you how to set it up next.
<h2>Setting Up <a href="http://Permit.io" target="_blank" rel="noopener nofollow">Permit.io</a> Local PDP Container</h2>
<a href="http://Permit.io" target="_blank" rel="noopener nofollow">Permit.io</a> recommends installing the PDP (Policy-Decision-Point) via Docker to use ABAC functionality.
Thus, create a <code>docker-compose.yml</code> file in the root directory of your Next.Js project.
<pre><code class="language-dockerfile">version: &#x27;3&#x27;
services:
 pdp-service:
 image: permitio/pdp-v2:latest
 ports:
 - &quot;7766:7000&quot;
 environment:
 - PDP_API_KEY=permit_key_xxxxxxxxx
 - PDP_DEBUG=True
 stdin_open: true
 tty: true
</code></pre>
<blockquote>
Note: replace the <code>PDP_API_KEY</code> with the permit API key you created when configuring <a href="http://Permit.io" target="_blank" rel="noopener nofollow">Permit.io</a>
</blockquote>
Start your docker daemon, then run the command to start the PDP service:
<pre><code class="language-env">docker compose up -d
</code></pre>
You can visit <code>http://localhost:7766</code> to confirm your container is running. See the response below:
<pre><code class="language-json=">{
 &quot;status&quot;: &quot;ok&quot;
}
</code></pre>
Since you are working locally, your PDP URL is the <code>http://localhost:7766</code> endpoint. Now, you will update your Next.Js <code>.env.local</code> file with your <a href="http://Permit.io" target="_blank" rel="noopener nofollow">Permit.io</a> API key and the PDP URL.
<pre><code class="language-javascript=">PERMIT_SDK_TOKEN=&lt; add your permit.io API key&gt;
PERMIT_PDP_URL=http://localhost:7766/
</code></pre>
<h2>Configuring <a href="http://Permit.io" target="_blank" rel="noopener nofollow">Permit.io</a> For ABAC</h2>
<a href="http://Permit.io" target="_blank" rel="noopener nofollow">Permit.io</a> allows policies to be set up through the Node SDK or the web console. We will use the web console since we are dealing with a reasonably visual topic.
<h3>Step 1: Modelling our System</h3>
We are creating a System where department members only have access to the projects specific to them. Each department has two designations: Developer and Manager. As a manager, you can perform more intricate operations on a project, like creating, reading, updating, and deleting. This privilege is only reduced by the manager’s employment status, which can either be full or part-time. Here is a visual representation of our model:
<img src="https://hackmd.io/_uploads/SJeD61E61l.png" alt="abac draw">
<h3>Step 2: Setting up custom User attributes and Resources</h3>
We only need one resource for this tutorial, but creating extra user attributes is crucial to setting up our ABAC policy. From the model, you will notice we have user designations such as department, roles, and employment status. <a href="http://Permit.io" target="_blank" rel="noopener nofollow">Permit.io</a> already provides default user attributes and options to create custom user attributes based on your use case.
You can create a user attribute by:
<ul>
<li>
Going to the Directory tab in your <a href="http://Permit.io" target="_blank" rel="noopener nofollow">Permit.io</a> dashboard, then click on Settings.
<img src="https://hackmd.io/_uploads/rJukLyDhyx.png" alt="Screenshot 2025-03-18 at 13.20.48">
</li>
<li>
Select User Attributes, then click Add Attributes.
<img src="https://hackmd.io/_uploads/B1v1IkPnJx.png" alt="Screenshot 2025-03-18 at 13.21.27">
</li>
<li>
In this section, add two custom attributes: department and employment_status as Strings.
</li>
</ul>
<img src="https://hackmd.io/_uploads/HkCFegVpJe.png" alt="Screenshot 2025-03-28 at 10.47.54">
Once you finish that, you can create the resource for your project. You can do that by:
<ul>
<li>Navigating to Policy → Resources.</li>
<li>Click on Create a Resource or Add Resource to create a Projects resource with the default actions (create, read, update, delete). Set up an ABAC option string called department for the resource and save.</li>
</ul>
<img src="https://hackmd.io/_uploads/r1GHNeV61g.png" alt="Screenshot 2025-03-28 at 11.03.30">
That is all for setting up a resource needed for ABAC.
<h3>Step 3: Configuring ABAC condition sets</h3>
After creating a resource, you must define ABAC User Sets and ABAC Resource Sets. These condition sets determine how users can access your resource and the actions they can perform.

claraekekenta's public Squad

AI has significantly impacted the tech sector; this tutorial introduces an AI-driven project management tool that utilizes ABAC for secure access control. The guide details setting up Appwrite for authentication and database storage, integrating Permit.io for defining user permissions, and using Deepseek R1 as the language model. The step-by-step instructions include creating accounts, setting up projects, and configuring access control policies.

Project Management Tool with ABAC Using Deepseek R1 and Permit.io

Great content. You really explained ABAC well

Thanks for sharing this detailed guide