SpiceDB: Flexible Permissions Database for the Internet Era
summary
Open source implementation of Google Zanzibar for relationship-based access control, built in Go with a gRPC API and drivers for CockroachDB and Postgres. It implements Zed tokens (opaque point‑in‑time stamps) and a 5s quantization to ensure consistent snapshots and reduce remote reads. Primary ops are check/expand/lookup; current deployment shows 95th‑percentile checks ≈22 ms, client/server cache hit ≈65%, and availability near 99.993%. A consistent hash ring and a planned “tiger cache” precompute transitive closures to improve hit rates.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:50Why do I need a specialized permissions database
- 3:48Requirements
- 6:12What is SpiceDB
- 6:36Data Model
- 10:25Permissions
- 16:20API
- 19:20New Enemy Problem
- 22:50Architecture Implementation
- 25:59Implementation Details
- 31:23Consistent Hash Rings
- 33:17Timestamps
- 36:03Quantization
- 42:04Performance
- 43:37Zanzibar
- 45:34Recap
- 46:25Questions
related talks
35mSpiceDB: open source, hyperscale authorization
16mAccess Granted with AuthZed
29mBuilding SpiceDB: A gRPC-First Database
38mHow Google built a Consistent, Global Authorization System with Zanzibar
39mFine grain access control for Kubernetes
40mHow Google Built a Consistent, Global Authorization System with Zanzibar
46mRebuilding Access Management with ReBAC
29mHow Google Built a Consistent, Global Authorization System with Zanzibar