May 2023 Summaries

The Netflix team collaborated with AuthZed to add Attribute-Based Access Control (ABAC) support to SpiceDB, an open-source authorization system inspired by Google Zanzibar. The goal was to enhance security and efficiency in the core Netflix application identity constructs. To achieve this, they introduced "Caveats" - a new design feature that allows for static input variables to be stored before evaluation, representing the multi-dimensional nature of Netflix application identities. This approach simplifies authorization policy specification and enables more flexible access control. The SpiceDB Caveats design integrates Google's CEL expression language and introduces a new result type, CAVEATED, to signal that a result depends on computing an unresolved chain of expressions. With this feature, Netflix can write caveats similar to match_fine, which takes lists of expected attributes, allowing specific applications to be authorized based on observed attribute values. The collaboration has resulted in a powerful paradigm bridging policy-based authorization and Relationship-Based Access Control (ReBAC), benefiting companies looking to modernize their authorization stacks with Zanzibar-based implementations.

In the context of caching, a timestamp represents a unique point in time and is used to evaluate sub-problems and their answers, ensuring consistency across multiple servers. SpiceDB uses consistent hashing to distribute cache entries across Zanzibar servers, allowing for efficient reuse of cache entries and minimizing latency. The system allows users to choose from four levels of consistency: fully_consistent, at_exact_snapshot, minimize_latency, and at_least_as_fresh, each making different tradeoffs between consistency, freshness, and performance. The choice of timestamp is crucial in determining the overall caching strategy, as it affects the staleness of results and the ability to reuse cache entries. By understanding how these concepts work together, SpiceDB can efficiently manage cache entries and provide low-latency responses while maintaining high availability.