A check is the core call of Zanzibar, and it is evaluated as a boolean expression.
The set operations of a check are converted to boolean operations. A query for all users with access to a document breaks into three: the engineers of the company, the admins anywhere in the world, and the public who hold a particular key.
- The branches are computed in parallel. With AND on all three, one branch that fails means the entire expression fails, so the other branches are cancelled. This is a branch cancellation.
- The same ACL checks are grouped together. With replicas, a read for 1 can hit node X and a read for 13 can hit node Y, although either node holds both. One query for 1 and 13 hits one replica, so Zanzibar groups the checks to minimize the hits on Spanner.
- A wide group is expensive to expand. The admins may be the admins of operations, finance, engineering and HR. The expansion is cached in an indexing system called Leopard, which reads off snapshots.