November 2023 Summaries

At AuthZed, they are building a platform around SpiceDB - an open-source, ReBAC-based authorization system inspired by Google Zanzibar. They have explored the differences between policy-based access control (PBAC) and ReBAC, highlighting that while PBAC solutions often use standard software development lifecycle tools and techniques, ReBAC systems like SpiceDB store relationships as facts and define a schema to relate these facts into a graph. This approach allows for more flexibility in handling authorization questions, including RBAC and ABAC. The authors argue that when all data for a policy decision can be statelessly derived from a policy engine, they tend to shine, but when external data needs to be queried, the performance of policy engines may not guarantee fast evaluation times. The authors also discuss their own use case at AuthZed, where they mix different approaches, including using a dedicated SpiceDB instance for permissions in the Serverless platform and leveraging policy-like features from Kubernetes projects. They highlight that whether PBAC or ReBAC is better suited depends on the authorization problems encountered.

The introduction of OTel instrumentation in SpiceDB allows for better visualization and understanding of how SpiceDB walks the graph, representing the schema. This enables developers to visualize the sequence of steps taken to respond to an API request, providing insights into the consistency model and tunable settings such as minimize_latency, which offers a good compromise between performance and security. The OTel instrumentation provides detailed traces of requests, including sub-problems being computed, dispatching, and querying the database, enabling developers to better understand the underlying logic of SpiceDB's authorization system.

The problem with permissions management is that companies often start by building their own authorization systems, which can become complex and difficult to maintain as the company grows. Companies may also face challenges such as scalability, compatibility, and data consistency issues. Custom code-based authorization systems have pros (flexibility) but cons (inflexibility, potential security risks), while policy engines offer a more abstracted approach with benefits (formally proven correct policies) but drawbacks (complexity, potential performance issues). Google's Zanzibar is a centralized authorization system built on top of a globally distributed database (Spanner), which provides scalability, flexibility, and a single view of permissions. However, it also has limitations (difficult to handle data available at request time) and requires careful consideration when choosing the right tool for the job. The open-source implementation of Zanzibar called SpiceDB is an alternative solution that addresses some of these limitations.

We're back` AuthZed has been busy building its team, onboarding new customers, and improving product offerings. The company's SpiceDB project has received significant updates, including the availability of caveats, a bulk check API, and integration with fine-grained access management and audit logging tools for administrative purposes. AuthZed has also expanded its community through a Discord server with over 1,500 members and GitHub discussions. The company has grown its team and made new hires, and its product offerings now include features like hotspot caching in Google Zanzibar and SpiceDB. Additionally, the company has been publishing articles and guest posts on various topics related to authorization systems and collaboration with other organizations.