AuthZ
(Relationship-Based Access Control)
A globally consistent, fine-grained access control platform inspired by Google Zanzibar, utilizing PostgreSQL Recursive CTEs and gRPC.
The Challenge
Modern distributed systems require complex, granular permission checks (e.g., 'Can User A view Document B which is inside Folder C owned by Group D?'). Hardcoding this logic into individual microservices creates unmaintainable sprawl.
I architected AuthZ as a centralized Google Zanzibar-style ReBAC (Relationship-Based Access Control) graph engine. Applications simply query AuthZ via high-speed gRPC. By utilizing PostgreSQL Recursive CTEs, the engine natively traverses deeply nested permission hierarchies. A dual-tier caching strategy (In-Memory L1 + Redis L2) ensures p95 authorization checks return in under 10ms.
System Architecture
graph TD
Client[Microservices] -->|gRPC Check| Gateway[API Gateway]
Gateway --> AuthZ[Authorization Service]
AuthZ --> L1[L1: In-Memory Cache]
L1 -->|Miss| L2[L2: Redis Cache]
L2 -->|Miss| Postgres[(PostgreSQL Recursive CTE)]
Gateway --> Schema[Schema Service]
Gateway --> Audit[Audit Service]
AuthZ -.->|Outbox Pattern| Kafka[Apache Kafka]
Kafka -.-> Audit
Key Features
Recursive Graph Traversal
Leveraged powerful PostgreSQL Recursive CTEs to navigate deeply nested group and permission hierarchies entirely within the database engine.
Sub-10ms Authorization
Engineered a high-performance, two-tier caching strategy using L1 In-Memory and L2 Redis to guarantee strict latency SLAs.
Microservices & gRPC
Independently scalable NestJS services communicating internally via lightning-fast gRPC protocols.
Zero-Data-Loss Auditing
Utilizes the Transactional Outbox pattern pushing state changes into Kafka to maintain an immutable ledger in the Audit Service.