Zanzibar is Google's authorization system, the one service that decides who can view, edit or own a document.
It stores trillions of access control lists and answers millions of queries per second with five nines of availability. More than 99% of the queries are reads.
A permission is a relation written in a single line, and a group can stand where a user does. The relations form a graph, and a check spreads out as a tree.
It is built like a multilevel cache:
- The servers. ACL servers keep the most used lists in memory and answer the reads and the writes.
- The store. Spanner holds the namespace configurations, the relation tuples and a change log.
- The shards. The data is sharded by object ID, so every relation of a document sits in one shard.
- The background. A watch service streams the change log to clients, a job creates snapshots, and Leopard uses both to pre-compute user sets.