March 2024 Summaries

ABAC is an attribute-based access control system that uses attributes on objects to determine access permissions. It allows for defining arbitrary sets of information to use for making decisions, unlike role-based access control which defines roles based on predefined categories. ABAC can be combined with ReBAC to provide the benefits of both approaches. SpiceDB has introduced the concept of caveats, which allows combining the flexibility of ABAC with the power and efficiency of ReBAC by applying ABAC-like policy to specific subsets of permissions decisions. This approach enables leveraging the benefits of attribute-based decision making with the efficiency of parallelization, structural graph walking, and event aggressive caching in SpiceDB.

AuthZed aims to simplify permissions for developers by addressing scalability and flexibility issues in permission models through the open-core project SpiceDB, which brings relation-based access control to the developer community. The company faces challenges in the cloud-native ecosystem, including operational and permission management complexities in microservices architectures. AuthZed addresses these challenges with a comprehensive permissions solution, leveraging AI and machine learning to enhance its capabilities and simplify the permissions modeling process for customers. Ultimately, Jake Moshenko envisions making AuthZed a ubiquitous solution in permissions management, fostering network effects by enabling different applications to use a unified permissions database, similar to Google's ecosystem.

AuthZed is a solution that caters to various companies, simplifying permissions management and enhancing product security and velocity by allowing flexible adjustments to meet changing requirements. The service provides a simplified approach to managing permissions requests efficiently for backend systems and web applications, facilitating secure and flexible access control decisions. AuthZed's schema allows for customization of permissions and relationships to tailor the service to specific application needs, establishing the rules of engagement during runtime operations where actual user permissions are managed and validated through API calls.

SpiceDB is an open-source permissions database inspired by Google's Zanzibar, offering flexibility for building authorization schemes like RBAC, ABAC, or FGA. It uses a graph database to store relationships between objects according to a purpose-built schema, allowing developers to issue authorization queries to get answers to questions like "does user 123 have access to document 456?" A key challenge in FGA is determining the level of granularity needed for permissions data, with too much granularity leading to high maintenance costs and not enough granularity potentially limiting flexibility. SpiceDB's underlying guidance recommends modeling the smallest resource possible to achieve a balance between flexibility and maintainability, while also considering trade-offs when necessary. By doing so, developers can optimize their permission models to reduce unnecessary complexity and costs, ultimately leading to more efficient and scalable authorization systems.