README

SpiceDB sets the standard for authorization that scales.
  Scale with
  Traffic • Dev Velocity • Functionality • Geography



  
   
  
   
  
   
  
   
  
   
  



  
	 
    
     
    



  
   
  


 What is SpiceDB?




SpiceDB is the most mature open source project inspired by Google's internal authorization system: [Zanzibar].

As of 2021, [broken access control became the 1 threat to web security according to OWASP][owasp].
With SpiceDB, platform and product teams can be be protected by answering this question easily: "can subject X perform action Y on resource Z?"

Similar to a relational database, developers define a schema, write data in the form of relationships, and then use SpiceDB's clients to issue permission checks in their application to determine what actions a user can take on a resource. Other queries are also possible, such as "What can subject do?" or "Who can access resource?".

SpiceDB is often ran as a centralized service shared across product suites and microservice architectures.

SpiceDB is focused purely on authorization and is designed to be fully agnostic to authentication solutions/identity providers.

[owasp]: https://owasp.org/Top10/A01_2021-Broken_Access_Control/

 What is Google Zanzibar?

In 2019, Google released the paper "[Zanzibar: Google's Consistent, Global Authorization System][zanzibar]" providing the original inspiration for SpiceDB.
The paper presents the design, implementation, and deployment of, Zanzibar, Google's internal system for storing and evaluating access control lists.
Originally designed for [Google+ Circles][circles], Zanzibar now sits at the core Google's entire product suite (Calendar, Drive, Maps, Photos, YouTube) and powers the Google Cloud IAM service.

While SpiceDB has gone on to innovate well beyond the functionality outlined in the paper, development of SpiceDB aims to always remain faithful to the paper's values and goals.

[zanzibar]: https://authzed.com/zanzibar
[circles]: https://en.wikipedia.org/wiki/Google+Circles

 Why SpiceDB?

- [World-class engineering][about]: painstakingly built by experts that pioneered the cloud-native ecosystem
- [Authentic design][zanzibar]: mature and feature-complete implementation of Google's Zanzibar paper
- [Proven in production][1M]: 5ms p95 when scaled to millions of queries/s, billions of relationships
- [Global consistency][consistency]: consistency configured per-request unlocks correctness while maintaining performance
- [Multi-paradigm][caveats]: caveated relationships combine the best concepts in authorization: ABAC & ReBAC
- [Safety in tooling][tooling]: designs schemas with real-time validation or validate in your CI/CD workflow
- [Reverse Indexes][reverse-indexes]: queries for "What can subject do?", "Who can access resource?"

[about]: https://authzed.com/why-authzed
[1M]: https://authzed.com/blog/google-scale-authorization
[caveats]: https://netflixtechblog.com/abac-on-spicedb-enabling-ne