← Back
Home › Systems › Security and identity

authorization-service

fine-grained authorization

Zanzibar, SpiceDB

SystemTechniques · 11Primitives · 30 authorization-service Causal consistency tokensdistributed · medium: Snapshot tokens (Zanzibar zookies) carried by clients so reads are at least as fresh as a prior writeQuorum replicationdistributed · medium: Leaderless replication: write to W of N replicas, read from R; overlap (R + W > N) makes reads see the latest completed write.›Transitive closure indexgraphs · medium: Segment/interval labelling of DAGs (commit graphs) for fast reachability queriesPolicy engines (PDP/PEP, Cedar, Reg…security · medium: Decide allow/deny for (principal, action, resource, context) in a separate engine with default deny, forbid-wins and an auditable list of determining policies.›Change data capturestorage · medium: Decode the database's own commit log into row-change events in commit order, with a resume position, so any consumer can mirror the data exactly.›LSM-treestorage · medium: Buffer writes in memory, flush them as immutable sorted files and merge in the background; turns random writes into sequential I/O.›MVCCstorage · medium: Keep timestamped versions of each row so readers see a consistent snapshot without blocking writers; the default concurrency control in modern databases.›Hybrid logical clocksdistributed · low: A 64-bit timestamp that tracks wall-clock time but never goes backwards and respects causality; the default timestamp for MVCC databases without atomic clocks.›Consistent hashingdistributed · low: Hash nodes and keys onto a ring; each key belongs to the next node clockwise, so membership changes move only about 1/n of keys.›BFS and DFSgraphs · low: The two basic graph traversals; BFS gives hop distances and levels, DFS gives discovery/finish order for cycles, components and topological order.›Authorization models (RBAC, ABAC, R…security · low: How to decide who may do what to which object; roles for coarse rules, relationships for sharing, and checks on every object.›Bloom filterdata-structures · low: Bit array answering "definitely not present" or "probably present" in about 10 bits per key for 1 % false positives; inserts are cheap, deletes impossible.›Hedged requestssystems · low: Sending a backup request after a latency percentile and taking the first answer to cut tail latencyLRU and CLOCKsystems · low: LRU evicts the least recently used entry via hash map plus linked list; CLOCK approximates it with a reference bit, so hits take no lock.›Request coalescingsystems · low: Collapse concurrent identical requests into one backend fetch (singleflight)Vector clocksdistributed · low: One counter per node; comparing two vectors tells whether events are ordered or concurrent, which is exactly what conflict detection needs.›Interval treedata-structures · low: Index of ranges that answers "which intervals overlap this point or range?" in O(log n + k); static sorted-array form is the compact, cache-friendly choice.›Topological sortgraphs · low: Order the vertices of a DAG so every edge points forward; the core of build systems, schedulers and dependency resolution, with cycle detection for free.›Recursive-descent parsingcompilers · low: Hand-written top-down parser with one function per grammar rule; simple, fast, with full control over error messages and recovery.›Consumer offsetsdistributed · low: Each consumer group stores one integer per partition, the next position to read, so a restarted consumer resumes where it left off with at-least-once delivery.›Message sequence numbersdistributed · low: A per-stream counter on every message lets the receiver detect loss, duplicates and reordering, ack cheaply and resume after reconnect with "send from N".›Write-ahead logstorage · low: Append each change to a checksummed sequential log and fsync it before touching data pages; the basis of crash durability in nearly every database.›Strongly connected componentsgraphs · low: Tarjan/Kosaraju SCCs for cycle detection in dependency graphs+ 4 more techniques+ 14 more primitives

Similar systems

Share the most building blocks with this one.

wide-column 16 %tiered-cache 15 %monorepo-vcs 15 %

In-house systems

Named systems of this kind at large companies, with their paper or write-up.

ZanzibarAlphabet