--- title: Analyzing Teleport RBAC with Z3: Regexes, queries and... description: An explanation of how the Z3 SMT theorem prover was used to build an analysis engine for Teleport's role-based access control system. Covers Z3 fundamentals... canonical: https://daily.dev/posts/analyzing-teleport-rbac-with-z3-regexes-queries-and-formal-methods-tvovgjt7k twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Analyzing Teleport RBAC with Z3: Regexes, queries and formal methods | daily.dev og:description: An explanation of how the Z3 SMT theorem prover was used to build an analysis engine for Teleport's role-based access control system. Covers Z3 fundamentals... og:url: https://daily.dev/posts/analyzing-teleport-rbac-with-z3-regexes-queries-and-formal-methods-tvovgjt7k og:image: https://api.daily.dev/og/posts/tvovGJt7K.png og:image:alt: Analyzing Teleport RBAC with Z3: Regexes, queries and formal methods og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Analyzing Teleport RBAC with Z3: Regexes, queries and formal methods **[Teleport](https://daily.dev/sources/teleport)** · 15 min read · 0 upvotes · 0 comments ## Summary An explanation of how the Z3 SMT theorem prover was used to build an analysis engine for Teleport's role-based access control system. Covers Z3 fundamentals (satisfiability, models, uninterpreted functions), how Teleport roles are compiled into boolean expressions over user traits and node labels, and how Z3's regex support (Concat, Union, Star, InRe, etc.) can determine whether two RBAC roles or regexes are logically equivalent. Also discusses practical complications like modeling required label sets and string functions such as email.local or regex.replace, and links to the open-sourced rbac-linter tool built during the contract. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I check if two regular expressions are logically equivalent using Z3? Build each regex as a Z3 regex expression (using Concat, Union, Star, Plus, Range, etc.), then assert z3.Distinct(r1, r2) and call solver.check(). If the result is unsat, the regexes are equivalent; if sat, the returned model is a counterexample string distinguishing them. Z3 supports the classic regex primitives plus unicode-aware functions like AllChar, Full, Empty, Intersect, and Complement. _daily.dev surfaces formal-methods techniques like this for developers comparing regex or policy logic._ ### How do I represent role-based access control rules as boolean expressions for a solver like Z3? Model each user trait and node label as a Z3 string variable (or as an uninterpreted function from strings to strings for a more scalable approach), then express allow/deny constraints as boolean combinations using equality, InRe for regex matching, and z3.And/Or. Comparing two roles for equivalence reduces to asserting z3.Distinct(role1, role2) and checking satisfiability; an unsat result means the roles are equivalent. _Developers designing access control systems can track formal verification patterns like this on daily.dev._ ### What issue occurs when using Z3's Set sort to model required label keys in RBAC constraints? When a large set of constraints only specifies which strings must be in a set, Z3's solver can satisfy them trivially by using the set containing all strings, equivalent to an uninterpreted function that always returns true. This breaks conformance testing for access checks, so constraints must also explicitly state which strings are not in the set to get meaningful results. _daily.dev helps engineers debugging solver-based access control modeling stay on top of these edge cases._ ## Similar posts on daily.dev - [sminez.dev](https://daily.dev/posts/sminez-dev-dmgjr9u1o) · Lobsters · 1 upvotes · 0 comments - [Zanzibar: How Google Answers “Can This User See This File?” a Few Million Times a Second](https://daily.dev/posts/zanzibar-how-google-answers-can-this-user-see-this-file-a-few-million-times-a-second-7jya8zw1s) · Medium · 0 upvotes · 0 comments --- Tags: [#python](https://daily.dev/tags/python) [View this post on daily.dev](https://daily.dev/posts/analyzing-teleport-rbac-with-z3-regexes-queries-and-formal-methods-tvovgjt7k) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Analyzing Teleport RBAC with Z3: Regexes, queries and formal methods","url":"https://daily.dev/posts/analyzing-teleport-rbac-with-z3-regexes-queries-and-formal-methods-tvovgjt7k","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/analyzing-teleport-rbac-with-z3-regexes-queries-and-formal-methods-tvovgjt7k"},"datePublished":"2026-08-23T12:22:51.559Z","dateModified":"2026-08-23T12:53:00.512Z","description":"An explanation of how the Z3 SMT theorem prover was used to build an analysis engine for Teleport's role-based access control system. Covers Z3 fundamentals...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/analyzing-teleport-rbac-with-z3-regexes-queries-and-formal-methods-tvovgjt7k","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"python","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Analyzing Teleport RBAC with Z3: Regexes, queries and formal methods"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/analyzing-teleport-rbac-with-z3-regexes-queries-and-formal-methods-tvovgjt7k#faq","mainEntity":[{"@type":"Question","name":"How can I check if two regular expressions are logically equivalent using Z3?","acceptedAnswer":{"@type":"Answer","text":"Build each regex as a Z3 regex expression (using Concat, Union, Star, Plus, Range, etc.), then assert z3.Distinct(r1, r2) and call solver.check(). If the result is unsat, the regexes are equivalent; if sat, the returned model is a counterexample string distinguishing them. Z3 supports the classic regex primitives plus unicode-aware functions like AllChar, Full, Empty, Intersect, and Complement. daily.dev surfaces formal-methods techniques like this for developers comparing regex or policy logic."}},{"@type":"Question","name":"How do I represent role-based access control rules as boolean expressions for a solver like Z3?","acceptedAnswer":{"@type":"Answer","text":"Model each user trait and node label as a Z3 string variable (or as an uninterpreted function from strings to strings for a more scalable approach), then express allow/deny constraints as boolean combinations using equality, InRe for regex matching, and z3.And/Or. Comparing two roles for equivalence reduces to asserting z3.Distinct(role1, role2) and checking satisfiability; an unsat result means the roles are equivalent. Developers designing access control systems can track formal verification patterns like this on daily.dev."}},{"@type":"Question","name":"What issue occurs when using Z3's Set sort to model required label keys in RBAC constraints?","acceptedAnswer":{"@type":"Answer","text":"When a large set of constraints only specifies which strings must be in a set, Z3's solver can satisfy them trivially by using the set containing all strings, equivalent to an uninterpreted function that always returns true. This breaks conformance testing for access checks, so constraints must also explicitly state which strings are not in the set to get meaningful results. daily.dev helps engineers debugging solver-based access control modeling stay on top of these edge cases."}}]} ```