Rebuilding Access Management with ReBAC
summary
Oodrive replaces scattered RBAC and a custom access model with relationship-based access control (ReBAC) by deploying SpiceDB on-prem for fine-grained, auditable graph checks (expand/reverse). The implementation integrates Postgres, Debezium change-capture, a Go gRPC client and a read-only microservice for chat, migrating legacy data via dual-write with reconciliation or queued tuple writers while addressing caching (four tiers) and scalability trade-offs observed in Google’s Zanzibar benchmarks.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 11:25Access Management challenges
- 20:01ReBAC and SpiceDB choice
- 27:21Technical implementation
- 36:30Experience and outlook
- 44:10Q&A
related talks
41mFine Grained Authorisation with Relationship-Based Access Control
47mFine Grained Authorisation with Relationship Based Access Control
45mReBAC at Scale: Let’s Save the p99
01h 01mSpiceDB: Flexible Permissions Database for the Internet Era
39mSecuring RAG Pipelines with Fine Grained Authorization
35mSpiceDB: open source, hyperscale authorization
44mSecuring RAG Pipelines with Fine Grained Authorization
33mFine-Grained Policies RBAC with OpenFGA