5 ms·

What aspect of this makes it "highly scalable"? It seems that the scalability limitation is the same as that of every graph - the efficiency of scaling a graph

What aspect of this makes it "highly scalable"? It seems that the scalability limitation is the same as that of every graph - the efficiency of scaling a graph beyond a single node. Not bashing what you are saying, just want to understand what makes it "highly scalable", as it isn't clear from the article. Also, I was wondering: Are ALL permissions stored as an Object::relation pair? i.e. do you need to register permissions for all new entities relationships, or do you have some way of storing more dynamic permissions?

samjs 5y ago
> What aspect of this makes it "highly scalable"? The idea is to put all data in one place, and then aggressively optimise for answering queries about that data. For authorization you're pretty much always asking specific reachability questions. That's where the design of the index comes into it. > Also, I was wondering: Are ALL permissions stored as an Object::relation pair? i.e. do you need to register permissions for all new entities relationships, or do you have some way of storing more dynamic permissions? In Zanzibar, there is a configuration format for computing relationships dynamically. E.g. "anyone who is an editor of a document is a viewer of a document". I'm not sure if they implemented something like that. If you're interested, I wrote a guide on relationship-based access control that includes a section on how Zanzibar(-like) systems fit in: https://www.osohq.com/academy/authorization-academy-chapter-4-modeling-relationships https://www.osohq.com/academy/authorization-academy-chapter-...
jzelinskie 5y ago
Full disclosure: I'm a founder of Authzed (YC W21)[0], which is a productized Zanzibar system. > just want to understand what makes it "highly scalable", as it isn't clear from the article. While this post might not cover in depth why their system is scalable, the Zanzibar paper[1] and this post[2] about Zanzibar covers why similar systems are scalable. A oversimplification would be to say that finding a path between two nodes in a graph can be recursively broken down and performed in parallel -- the Authzed implementation looks roughly similar to a map reduce. >Are ALL permissions stored as an Object::relation pair? i.e. do you need to register permissions for all new entities relationships, or do you have some way of storing more dynamic permissions? Zanzibar implementations do have graph schemas (called Namespace Configs in the paper) which offer set operations for computing dynamic relationships. When you create a new user or object in your app, you typically also write a few relationships into Zanzibar and the rest of their permissions are implicitly granted through the computed definitions in your schema. If you're interested in learning more about Zanzibar, we're giving a PapersWeLove talk that will be streamed on Twitch next week: https://www.meetup.com/papers-we-love/events/278148236/ https://www.meetup.com/papers-we-love/events/278148236/ [0]: https://authzed.com https://authzed.com [1]: https://research.google/pubs/pub48190/ https://research.google/pubs/pub48190/ [2]: https://authzed.com/blog/what-is-zanzibar/ https://authzed.com/blog/what-is-zanzibar/
- victor106 5y ago
  authzed looks cool. Any plans to release a Java library?
  - jzelinskie 5y ago
    Our API is gRPC, so we can easily generate some Java bindings. For a more ergonomic client, we'd have to partner to flesh something out. Feel free to put some time on our calendar, everyone on the call will be engineer that's deep in the weeds: https://calendly.com/d/mzs5-cxvx/authzed-introduction https://calendly.com/d/mzs5-cxvx/authzed-introduction
- AceJohnny2 5y ago
  Thanks for excellent explanation! I'm disappointed your work on Authzed hasn't hit HN front page before, not for lack of trying on your part!
  - jzelinskie 5y ago
    We haven't done an official "Launch HN" yet. For now, we're heads-down with our early adopters fleshing out developer UX and a friendlier API. We started by implementing Zanzibar as faithfully as possible, but that doesn't make this technology widely available to developers of all walks of life.
    - AceJohnny2 5y ago
      Nevertheless, your separate posting [1] of your "What is Zanzibar" article deserved more attention, and IMHO is useful to drum up attention to your problem/solution space. [1] https://news.ycombinator.com/item?id=27143342 https://news.ycombinator.com/item?id=27143342

samjs 5y ago

> What aspect of this makes it "highly scalable"? The idea is to put all data in one place, and then aggressively optimise for answering queries about that data. For authorization you're pretty much always asking specific reachability questions. That's where the design of the index comes into it. > Also, I was wondering: Are ALL permissions stored as an Object::relation pair? i.e. do you need to register permissions for all new entities relationships, or do you have some way of storing more dynamic permissions? In Zanzibar, there is a configuration format for computing relationships dynamically. E.g. "anyone who is an editor of a document is a viewer of a document". I'm not sure if they implemented something like that. If you're interested, I wrote a guide on relationship-based access control that includes a section on how Zanzibar(-like) systems fit in: https://www.osohq.com/academy/authorization-academy-chapter-4-modeling-relationships https://www.osohq.com/academy/authorization-academy-chapter-...

jzelinskie 5y ago

Full disclosure: I'm a founder of Authzed (YC W21)[0], which is a productized Zanzibar system. > just want to understand what makes it "highly scalable", as it isn't clear from the article. While this post might not cover in depth why their system is scalable, the Zanzibar paper[1] and this post[2] about Zanzibar covers why similar systems are scalable. A oversimplification would be to say that finding a path between two nodes in a graph can be recursively broken down and performed in parallel -- the Authzed implementation looks roughly similar to a map reduce. >Are ALL permissions stored as an Object::relation pair? i.e. do you need to register permissions for all new entities relationships, or do you have some way of storing more dynamic permissions? Zanzibar implementations do have graph schemas (called Namespace Configs in the paper) which offer set operations for computing dynamic relationships. When you create a new user or object in your app, you typically also write a few relationships into Zanzibar and the rest of their permissions are implicitly granted through the computed definitions in your schema. If you're interested in learning more about Zanzibar, we're giving a PapersWeLove talk that will be streamed on Twitch next week: https://www.meetup.com/papers-we-love/events/278148236/ https://www.meetup.com/papers-we-love/events/278148236/ [0]: https://authzed.com https://authzed.com [1]: https://research.google/pubs/pub48190/ https://research.google/pubs/pub48190/ [2]: https://authzed.com/blog/what-is-zanzibar/ https://authzed.com/blog/what-is-zanzibar/

victor106 5y ago
authzed looks cool. Any plans to release a Java library?
- jzelinskie 5y ago
  Our API is gRPC, so we can easily generate some Java bindings. For a more ergonomic client, we'd have to partner to flesh something out. Feel free to put some time on our calendar, everyone on the call will be engineer that's deep in the weeds: https://calendly.com/d/mzs5-cxvx/authzed-introduction https://calendly.com/d/mzs5-cxvx/authzed-introduction
AceJohnny2 5y ago
Thanks for excellent explanation! I'm disappointed your work on Authzed hasn't hit HN front page before, not for lack of trying on your part!
- jzelinskie 5y ago
  We haven't done an official "Launch HN" yet. For now, we're heads-down with our early adopters fleshing out developer UX and a friendlier API. We started by implementing Zanzibar as faithfully as possible, but that doesn't make this technology widely available to developers of all walks of life.
  - AceJohnny2 5y ago
    Nevertheless, your separate posting [1] of your "What is Zanzibar" article deserved more attention, and IMHO is useful to drum up attention to your problem/solution space. [1] https://news.ycombinator.com/item?id=27143342 https://news.ycombinator.com/item?id=27143342