ABAC on SpiceDB: Enabling Netflix’s Complex Identity Types

The Netflix team collaborated with AuthZed to add Attribute-Based Access Control (ABAC) support to SpiceDB, an open-source authorization system inspired by Google Zanzibar. The goal was to enhance security and efficiency in the core Netflix application identity constructs. To achieve this, they introduced "Caveats" - a new design feature that allows for static input variables to be stored before evaluation, representing the multi-dimensional nature of Netflix application identities. This approach simplifies authorization policy specification and enables more flexible access control. The SpiceDB Caveats design integrates Google's CEL expression language and introduces a new result type, CAVEATED, to signal that a result depends on computing an unresolved chain of expressions. With this feature, Netflix can write caveats similar to match_fine, which takes lists of expected attributes, allowing specific applications to be authorized based on observed attribute values. The collaboration has resulted in a powerful paradigm bridging policy-based authorization and Relationship-Based Access Control (ReBAC), benefiting companies looking to modernize their authorization stacks with Zanzibar-based implementations.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.