SpiceDB: open source, hyperscale authorization
summary
Open source SpiceDB implements a Zanzibar-inspired model to centralize permissions, run relationship traversals (ReBAC) at low latency, and answer queries like lookups and who-can-access. The demo uses a WASM playground and CLI to write schema, insert relationships, and run explainable checks; adopters range from startups to Fortune 50 (Netflix, GitHub, Google, Adobe, Plaid, Reddit). It supports progressive migration, uncovers unexpected grants, and ships a materialize option for denormalized filtering at hyperscale.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:04Authentication vs authorization
- 3:09Application permissions challenges
- 7:26Google Plus circles and Zanzibar
- 9:30Zanzibar's distributed systems
- 10:55Open-sourcing SpiceDB
- 12:21SpiceDB developer experience
- 13:26Scale in SpiceDB
- 14:30Centralized authorization
- 17:42Benefits of centralized auth
- 20:33ReBAC
- 23:45SpiceDB playground and modeling
- 25:28Advanced queries in SpiceDB
- 26:54Key takeaways
- 27:35Q&A
related talks
01h 01mSpiceDB: Flexible Permissions Database for the Internet Era
29mBuilding SpiceDB: A gRPC-First Database
39mFine grain access control for Kubernetes
16mAccess Granted with AuthZed
46mRebuilding Access Management with ReBAC
33mHow to Prevent AI Agents from Accessing Unauthorized Data
39mSecuring RAG Pipelines with Fine Grained Authorization
38mHow Google built a Consistent, Global Authorization System with Zanzibar