February 2026 Summaries

The text discusses the complexities of access control in dynamic environments, using a wedding party analogy to illustrate the limitations of traditional policy engines in handling ambient context and relational data. It contrasts two approaches to access control: traditional policy engines, which use pre-compiled, stateless rules, and Relationship-Based Access Control (ReBAC), which evaluates permissions based on current relationships and context. The text highlights the challenges posed by AI agents, which require dynamic access decisions and cannot be managed effectively with static policies. It notes that AI agents, like human users, need access systems that can adapt to changing relationships and contexts in real-time. The text argues that while traditional access control methods like access control lists and policy-based systems have their place, the future of authorization—especially for AI—lies in systems like Google's Zanzibar and SpiceDB, which are designed to handle dynamic, relationship-driven authorization at scale.

The discussion highlights the limitations of using policy engines for authorization in AI agents and advocates for relationship-based access control (ReBAC) as a more suitable alternative. Policy engines, while fast and flexible, require extensive data assembly and are typically stateless and unaware, making them less ideal for dynamic, relationship-heavy environments like those involving AI agents. In contrast, ReBAC treats AI agents as first-class objects with evolving access permissions similar to humans, unifying data and policy into a single permission system, as exemplified by the more concise and efficient SpiceDB model compared to Cedar. While policy engines are effective for straightforward, data-present decisions such as IP allowlists, ReBAC offers a more natural fit for complex authorization scenarios in the agentic future, where AI agents require flexible, relationship-based access akin to human interactions.

SpiceDB has introduced a Foreign Data Wrapper (FDW) for PostgreSQL, allowing real-time authorization context from SpiceDB to integrate into Postgres queries without data duplication, policy rewriting, or embedded authorization logic. Starting with version 1.49.0, this FDW enables PostgreSQL to query SpiceDB at runtime by exposing permissions and relationships as foreign tables supported by SpiceDB's APIs. This integration aims to provide a unified access point for both application and permission data, translating SQL operations into live SpiceDB API calls, leveraging its scalability and optimizations. While the FDW does not completely resolve the dual-write issue, as writes to relationships are executed in SpiceDB's own transaction, it reduces the impact by rolling back the surrounding PostgreSQL transaction if a write fails. Although still experimental, the FDW has been designed with real-world use cases in mind, and users are encouraged to try it out and provide feedback as it progresses in development.

SpiceDB, an implementation of relationship-based access control (ReBAC), has evolved to enhance authorization performance, addressing user demands for lower latency. The improvements include de-duplicating requests, decomposing problems into sub-problems, caching, consistent hashing, batching database queries, and SQL optimizations. However, these strategies often overlooked the "shape" of customer data, which is crucial for efficient query execution. SpiceDB introduced a new experimental query planner to optimize the CheckPermission API by analyzing the structure of queries and graphs in real-time, making intelligent decisions about traversal paths based on data statistics. The planner reorders evaluation steps to minimize workload, thereby improving efficiency in scenarios like intersections and unions by choosing cost-effective paths. Although promising, SpiceDB acknowledges that query planners can display erratic behaviors in certain cases, much like the Postgres query planner, and plans extensive testing before broadly deploying these optimizations. Feedback from users is encouraged to refine and address any edge cases, and opportunities for employment are available for those interested in contributing to this innovative work.