Used to be a Googler and worked on an ACL model built on top of Zanzibar. I didn't work directly on Zanzibar so listen to ruomingpang over me. > 3. There's not

Used to be a Googler and worked on an ACL model built on top of Zanzibar. I didn't work directly on Zanzibar so listen to ruomingpang over me. > 3. There's nothing Zanzibar can do but "pointer chase", resulting in a large number of serial ACL checks? Zanzibar enforced a max depth and would fail if the pointer-chasing traversed too deeply. Zanzibar would also fail if it traversed too many nodes. > 4. How do clients consistently update ACLs alongside their "reverse edges"? One of the recommended solutions was to store your full ACL (which includes a Zookie) in the same Spanner row of whatever it protected. So, if your ACL is for books, you might have: CREATE TABLE books ( book SERIAL PRIMARY KEY acl ZanzibarAcl ); Alternately, you could opt to only store the current zookie instead of the full ACL. Then the check becomes: 1. Fetch Zookie from Spanner 2. Call Zanzibar.Check with the zookie > but how do I consistently view which groups a user is a member of? I remember this as a large source of pain to implement. Zanzibar didn't support this use-case directly. As rpang mentioned in a sibling comment, you need an ACL-aware index. Essentially, the algorithm is: 1. Call Zanzibar.Check on all groups the user might be a part of. There's a bunch of clever tricks you can use to prune the search space that I don't know the details of.