relay-authz
Authorization service
A relationship-based authorization service modeled on Google's Zanzibar paper. It answers "can this user do this?" by walking nested groups and folders in PostgreSQL, and "what can this user access?" in 7 queries instead of 45,760. Revision tokens keep revoked access out of the Redis cache.
Notes & limits
Google's production system stores trillions of tuples in Spanner, replicated across data centers, and caches shared subproblems. This runs on a single database with no sharding or replication, and caches only whole checks.
Go · PostgreSQL · Redis · Docker · k6



