How Google built a Consistent, Global Authorization System with Zanzibar
summary
Google claims Zanzibar handles 10 million client queries per second by modeling permissions as Relationship-Based Access Control: a schema of users and objects, relation tuples that record who is owner/member/editor, and APIs to write relationships, check permissions and lookup subjects or resources. Correctness uses zookie timestamps to avoid the “new enemy” stale-cache problem; scale relies on distributed caching, consistent hashing, lock tables and full-read caching for viral hotspots. An open-source reimplementation (SpiceDB) demos this, but adoption requires dual-write integration and schema design.
AI-written summary · about
chapters (18)
- 0:00Google’s authorization system intro
- 2:58Authentication vs authorization
- 5:26Role-based access limits
- 6:30Relationship-based access control
- 9:01Zanzibar authorization graphs
- 11:09Zanzibar open-source alternatives
- 12:13SpiceDB mirrors Zanzibar
- 13:14SpiceDB schemas and relationships
- 14:40SpiceDB relationship tuples
- 15:44SpiceDB permission checks
- 17:10SpiceDB subject/resource lookup
- 19:00Zanzibar scale and caching
- 21:09New enemy problem solved
- 22:56Low-latency authorization optimizations
- 27:17When to use Zanzibar-like systems
- 29:26OWASP access control risks
- 30:33Next steps and resources
- 31:15Q&A
related talks
40mHow Google Built a Consistent, Global Authorization System with Zanzibar
29mHow Google Built a Consistent, Global Authorization System with Zanzibar
21mZanzibar: Google’s Consistent, Global Authorization System
16mAccess Granted with AuthZed
29mHow to Prevent AI Agents from Accessing Unauthorized Data
01h 01mSpiceDB: Flexible Permissions Database for the Internet Era
44mSecuring RAG Pipelines with Fine Grained Authorization
54mFine-Grained Authorization for Modern Applications