January 2025 Summaries

DeepSeek has emerged as a significant phenomenon in the AI industry since its announcement in late December 2024, captivating both its capabilities and potential implications. The model's unique combination of features, including being open-source with impressive reasoning capabilities at lower training costs, is noteworthy. However, concerns surrounding its origin, data security, and biases have raised skepticism. Despite these concerns, users and companies are increasingly interested in exploring DeepSeek's capabilities, and organizations can adopt permissions systems to define data access controls. SpiceDB offers a robust framework for secure AI integration by providing fine-grained permissions and controlling both data exposure and action boundaries, making it particularly valuable for organizations that want to leverage DeepSeek's capabilities in a controlled environment.

SpiceDB has introduced a new experimental feature called Relationship Expiration, which allows users to specify an expiration time for relationships, making it easier to model access control and cleanup. This feature is designed to improve developer experience and address real-world requirements outside of the Google Zanzibar paper's scope. The implementation uses a unique approach by pushing logic into the underlying datastore to avoid inconsistencies caused by distributed systems' clock skew. To try out this feature, users need to enable an experimental flag, annotate their schema with expiration support, and provide a timestamp for the OptionalExpiresAt field when writing relationships. This new feature is part of SpiceDB's ongoing journey to achieve peak performance and deliver the best product for scaling authorization in diverse enterprise use-cases.

AuthZed has renewed its SOC2 compliance, with reports now available on security.authzed.com. The author reflects on their personal feelings towards compliance, noting that it's not just about technical security but also about building trust with customers and partners. The author acknowledges that engineering teams often view compliance as a nuisance, but emphasizes the importance of transparency and maturity in business processes. Compliance is seen as a necessary evil to ensure consistency across supply chains, rather than a checkbox to do business.

The dual-write problem arises when a system uses both SpiceDB for authorization and an application database, leading to inconsistencies between the two. To address this issue, various approaches can be taken, including doing nothing, out-of-band consistency checking, making SpiceDB the source of truth, event sourcing, command-query responsibility segregation (CQRS), durable execution environments, and transactional outbox patterns. Each approach has its advantages and disadvantages, and the choice depends on the system's shape, domain requirements, and organizational appetite for change. Centralizing data required for authorization decisions can lead to big wins in consistency, performance, and safety, but it requires effort.