Turnstile: A Hierarchical Authorization System
summary
Turnstile is an in-house authorization system that returns Boolean allow/deny decisions from a cached in-memory graph database, claiming ABAC/ReBAC expressiveness while centering explicit hierarchy. Policies model users and resources as trees (example rules about who can eat which cake), add orthogonal dimensions by referencing multiple trees for orthogonal axes, and attach edge-level constraints like day-of-week. Identities sync from Active Directory, caches serve low-latency queries, and group joins use primary/secondary approvers.
AI-written summary · about
chapters (6)
- 0:00Introduction to authorization
- 2:28Goals for the system
- 9:34Designing the data model
- 15:34Hierarchical resource trees
- 20:10System architecture overview
- 23:19Future plans and scaling
related talks
06mThe Root of Auth Things
26mCan It Be Done? Building Fine-Grained Access Control for Back...
25mThe Invisible Fortress: Embedding Zero-Trust Governance in the Supergraph
16mAccess Granted with AuthZed
09mFlexible Authorization:Storing and Managing Rules in DB
25mModernizing Authorization: From Basic Roles to Decoupled ABAC
41mFine Grained Authorisation with Relationship-Based Access Control
51mAuthorization beyond @RolesAllowed