Apart from read and write, Zanzibar has three calls, watch, check and expand, and it runs background jobs.
- Watch. Zanzibar publishes events to all subscribers for a namespace. A person who is out of a company loses all access immediately, because the change is an event. The response contains a zookie.
- Check. It asks whether a person has access to an object, such as edit access to a video on Drive. It contains a user set, and the set can be nested.
- Expand. It gives the list of user IDs in a set, such as all the engineers at Google.
Three jobs run in the background: periodic snapshots in each namespace, periodic deletion of old snapshots, which is garbage collection, and indexing of large and deeply nested sets.
A group may be defined by another group, so evaluating or expanding it takes time. A response is wanted in less than 10 milliseconds for 95% of the time, and a large set of 40 thousand engineers is hard to fetch one by one. Such sets are indexed.