Company
Date Published
Author
Karan Kajla
Word count
1344
Language
English
Hacker News points
None

Summary

Google Zanzibar is a popular authorization solution that has gained traction in the industry, particularly among modern, fine-grained use cases and large-scale cloud-native applications. Its relationship-based access control (ReBAC) paradigm provides an intuitive and uniform data model for representing authorization, which feels familiar to existing database schema designs. This approach allows for flexibility, scalability, and representation of various authorization models, including role-based and attribute-based access control. Zanzibar's namespaces enable the assignment of meaning to relationships, separating authorization logic from application logic, making it easier to define rules and policies. The system is stateful, centralized, and query-able, allowing clients to audit privileges for regulatory compliance or understand the impact of changes before applying them. However, this design comes with performance trade-offs, which are mitigated by global distribution and aggressive caching. WorkOS Fine-Grained Authorization (FGA) builds upon Zanzibar's concepts, introducing slight variations to improve developer experience and add functionality, such as policy-based warrants that can reference dynamic contextual data for attribute-based access control scenarios.