Design an authorization service like zanzibar
PremiumSecurity systemHard
- ReBAC
- Relation tuples
- Consistency tokens
Quick answer
This security system interview question asks you to design an authorization service like zanzibar. Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.
The problem
Design a global authorization service, like the relationship-based permission systems behind large document products, that answers 'can user U do action A on object O?'. It stores who relates to what as relation tuples. The hard parts are a million checks per second under 10 ms and never using stale permissions to expose new content.
Documents, file storage, calendar and video apps share one permission model: users, groups that contain groups, folders that pass access to their children, and public links. Each app calls the service on every read and share, so it sits on the critical path of every product.
What must an authorization service like zanzibar do?
- Check: Answer allowed or denied for (object, relation, user), following nested groups and folder inheritance.
- No new enemy: If Ana removes Bob from a doc and then adds new content, Bob must never see that content; checks must never use permissions older than the content they protect.
How well must it do it?
- Latency: Check p95 under 10 ms and p99 under 50 ms in every region.
- Correctness: Never allow access that the tuples at the evaluated snapshot do not grant.
What scale should you design for?
Use these numbers in your estimates.
The scale numbers unlock with this questionUnlock
Key concepts
- ReBAC
- Relation tuples
- Consistency tokens
- New enemy problem
- Userset rewrites
- Snapshot reads
How you’ll practise
- Requirements and assets
- Threat model
- Identity and access
- Data protection
- Detection and response
- Wrap-up
Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.
What do interviewers look for?
In any security system design round.
- Starts with a clear threat model
- Layers defences instead of relying on one control
- Covers authentication, authorisation and secrets
- Plans detection, alerting and response
- Protects data in transit and at rest
- Balances security against usability and cost
Questions people ask about this interview question
- Which design type is this question?
- It is a security system question. You design an authorization service like zanzibar and explain your choices the way you would in an interview.
- Is this question asked at entry level?
- It is marked Hard. It suits engineers preparing for senior interviews, where you are expected to drive the discussion and go deep on trade-offs.
- What should I cover first?
- Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
- Can I practise it for free?
- It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.
Related questions
Updated · Written by the SevyDevy team