System Design

Authorization models Study Portal

Twelve access-control designs, from self-contained tokens to Zanzibar and policy engines: where the check happens, how fast access can be revoked, pros and cons, and how to pair them with a tenancy model
Flash Cards Practice
System Design / Authorization models / Key takeaways

Authorization models · Key takeaways

1 min read
Senior16 min read
Rapid overview

Key takeaways

  • Two questions decide the design: where the check lives, and how fast access can be revoked.
  • Self-contained tokens are fast and irrevocable until expiry; keep them short-lived with rotating refresh tokens.
  • Denylist revokes a token; versioning revokes a user; both are a cached lookup.
  • Gateways do coarse checks; ownership checks belong where the data is.
  • Phantom and reference tokens make revocation instant at the cost of a lookup.
  • RBAC for job roles, ReBAC for sharing and hierarchies, PBAC for attribute rules.
  • Machines get their own client identities; never share a user's password.
  • Choose tenancy and authorization together, eliminating options on the hardest constraint first.
  • A cached grant outlives its deletion; a permission version bumped on every grant change makes revoke near-instant for one integer compare.
  • Integrations get grants like users, scoped to the tenants they serve.

See also