spicedb

Disclosure: I'm a cofounder of Authzed, a YC company building a permissions database[0] inspired by Google's Zanzibar paper[1]. This is actually a really hard problem and depends on the systems with which you are integrating. We call this problem "ACL filtering"[2] and there are two general strategies: pre and post filtering. We have a blog post[3] describing our API for pre-filtering which can stream results that you can then use build a SQL query or data-structures like bloom filters/bitmaps. We currently have a proposal on GitHub[4] for an extension to that strategy adding a denormalization/caching layer (which is applying a similar strategy to the Leopard Indexing system internally at Google). You might also be surprised at the performance you can achieve with post-filtering by building an iterator in your programming language of choi

We have it on our backlog[0] to add documentation on how to run it with Kubernetes, at least. Very sorry about the "work in progress" moniker on our v1 APIs. We developed the v1 APIs based on our real-world experience running the Authzed.com service for ourselves and others, and we just finished their implementation and porting everything over. We will remove that warning ASAP! One thing to note though, is that we thought about calling our v1 APIs v5 or something, because we didn't want to give the impression that they will never change. We intend to continue to improve the APIs, sometimes in backward incompatible ways, but will just keep the existing APIs around for a very long™ period of time, similar to how Stripe handles their API versioning.[1] [0] https://github.com/authzed/spicedb/issues/147 [1] https://stripe.com/docs/api/versioni

Disclosure: Another founder of Authzed, here. Also, in case anyone was wondering, yes, SpiceDB is reference both Zanzibar and a popular sci-fi novel that will be in cinemas shortly. >1. How does this compare with Ory Keto? The blog post has a section dedicated to how SpiceDB improves on the Zanzibar paper[0]. Keto was originally a different project that has been rewritten to be Zanzibar-like. It is missing lots of the core functionality that I'd personally consider requirements to really be faithful to the paper: horizontally scalable, bounded staleness (Zookies), and userset rewrites, for example. ORY also develops a whole identity suite, while we're attempting to stay laser-focused on permissions and maintain vendor-neutrality. >2. Can it be nativity (I can integrate in Postgres SQL) integrated with Row Level Security in Postgres? We ha