Re:Aserto: Developer API for permissions and RBAC
by wereHamster on Wednesday February 16, 2022 @03:02PM
(#30364967)
Zanzibar has a notion of «User sets» to allow expressing conditions such as «File X can be viewed by (all users who can view Folder Y)» to avoid too much duplication in the rule sets. One challenge they had was to make resolving these rules not too slow, since that forms basically a graph (= graph traversal)
[ Parent
| on HN ]
Re:Aserto: Developer API for permissions and RBAC
by kache_ on Wednesday February 16, 2022 @03:26PM
(#30365225)
Reading the Zanzibar paper is actually how I learned about how powerful of an optimization technique denormalization could be
Re:Aserto: Developer API for permissions and RBAC
by ogazitt on Wednesday February 16, 2022 @06:07PM
(#30367106)
It's definitely a good paper :)
Denormalization has been around since Date/Codd invented 6NF and relational databases, and then we all realized that most applications have to precompute some joins in order to execute in a performant fashion. In SQL Server we used to call them "materialized views".
Re:Aserto: Developer API for permissions and RBAC
by ogazitt on Wednesday February 16, 2022 @06:05PM
(#30367087)
Yes, flattening the graph is essential to getting reasonable performance.
A separate (difficult) problem is to keep all the tuple data consistent with the data in your store (often these contain duplicate info).