How Google Built a Consistent, Global Authorization System with Zanzibar
summary
Claims a consistent, global authorization system (Zanzibar) that sustains more than 10 million client queries per second, implements Relationship-Based Access Control via relation tuples and DAG traversal, and solves the “new enemy” race with a zooi timestamp per change. Architecture uses subproblem decomposition, aggressive hotspot caching, Spanner-like storage and denormalized indexing. Practical paths include open-source implementations such as SpiceDB and a noted fork used by Google Cloud IAM.
AI-written summary · about
chapters (14)
- 0:00Zanzibar intro and Google auth
- 2:10Authentication vs authorization
- 3:58ACLs to relationship access
- 7:08Relation tuples for relationships
- 9:38Building a directed acyclic graph for permissions
- 11:44Zookies solve new enemy
- 14:59Scaling with sharding and cache
- 17:30Hotspot caching strategies
- 23:30Zanzibar architecture flow
- 25:16When to use Zanzibar
- 26:41Open-source Zanzibar
- 28:51SpiceDB demo and modeling
- 33:32Why auth is critical
- 35:38Zanzibar next steps
related talks
38mHow Google built a Consistent, Global Authorization System with Zanzibar
29mHow Google Built a Consistent, Global Authorization System with Zanzibar
21mZanzibar: Google’s Consistent, Global Authorization System
29mHow to Prevent AI Agents from Accessing Unauthorized Data
16mAccess Granted with AuthZed
01h 01mSpiceDB: Flexible Permissions Database for the Internet Era
44mSecuring RAG Pipelines with Fine Grained Authorization
39mSecuring RAG Pipelines with Fine Grained Authorization