ReBAC
Authorisation derived from a graph of relationships, such as 'user is member of team that owns folder that contains document'.
ReBAC stores relationship tuples (document:42#viewer@team:payments#member) and answers checks by walking the graph. Google's Zanzibar paper (2019) popularised it; OpenFGA, SpiceDB and Permify are open implementations.
It fits collaborative products where sharing and inheritance matter: folders, organisations, projects, nested groups. Listing "everything this user can see" and "everyone who can see this" are both supported queries, which RBAC and ABAC struggle with.
Costs: a separate, highly available authorisation service in the request path; keeping tuples in sync with the application database; and consistency, which Zanzibar solves with zookies so a check is never evaluated against data older than the content it protects.