eacl

to SpiceDB's consistency semantics, so you can run these queries against the database as-of now, or <N seconds ago> via `at-least-as-fresh` semantics for better cache reuse. SpiceDB is the most faithful open-source implementation of Google Zanzibar, and is used OpenAI, Reddit and Netflix. Zanzibar powers Google Drive, YouTube, Gmail and Google Calendar, serving billions of authorization requests per day over billions of Relationships. "Situated" here means that permission data co-exist with your application data. This has several advantages over external AuthZ: - Reduced network latency (no network hop to external system), - Strong local consistency, - Scale reads by scaling Peers horizontally, and - Real-time UI view maintenance – tail the tx-log and run `eacl/lookup-subjects` for changed permissioned entities and notify online users of novelty, instead of polling or re-querying for all online users. Rationale: I spent the better half of 2024 integrating with SpiceDB at a former employer. SpiceDB is great, but it becomes non-trivial to keep an external authorization system in-sync, especially when there is an impedance mismatch between your data and SpiceDB’s 3-tuple Relationship schema. Plus, you also have to deal with eventual consistency. So, you change your data model to match the Spice schema to make syncing easier. Now you can tail the transactor log via `d/listener` and write Relationship changes 1-for-1. But once you do that, you might as well run your permission queries in your application and then you have one less system to deal with...and this is exactly what EACL does. You still retain the option to migrate to SpiceDB later. EACL is aimed at a different scale from SpiceDB: Spice is benchmarked against 100B Relationships. EACL aims for ~1-100M Relationships in a situated environment, but there is no reason it won't scale further if you scale out Peers. EACL is open-source under EPL 2.0.

in the Datahike HTTP Server: https://github.com/replikativ/datahike/blob/1ea8972a980e2e3b...

ric Clojure. IMHO, EACL is currently the best-in-class authorization library in the Clojure ecosystem and is improving every week. ReBAC subsumes both ABAC & RBAC. I recently applied for Clojurists Together funding to improve cursors for intermediate resource traversal, which is the primary perf. bottleneck. EACL was not "vibecoded" as all tests were written by me and all code is human-reviewed, but EACL would not be possible for a single engineer to build mainly in his spare time without AI assistance. Docs with rationale: https://eacl.dev/

oblem-with-extern... IMO, if you need fine-grained permissions, EACL is currently best-in-class for the Clojure ecosystem. EACL is especially suited to Electric Clojure applications and can be used to populate menus in real-time. EACL would not have been possible to build solo in my spare time without modern AI models to rapidly implement specifications and test against human-written tests. Here is a ~7-minute screen recording of EACL used from an Electric Clojure application for real-time ReBAC queries: https://x.com/PetrusTheron/status/1996344248925294773

chema. I realized that if we modelled our AuthZ Relationships directly in Datomic, all our syncing problems would go away: you can simply tail the Datomic transactor queue and instantly create or delete Spice relationships in real-time. But once you do that, you might as well model the permission schema as well, and if you go one step further, you can implement the permission graph traversal directly in Clojure to avoid a network hop. And that is exactly what EACL is. EACL (Enterprise Access ControL) is an embedded authorization library that lives next to your data in Datomic and avoids an external network hop. EACL is suitable for small-to-medium scale, while giving you the option to migrate to SpiceDB in future when you need more scale and consistency semantics. EACL implements the SpiceDB gRPC API as an idiomatic Clojure protocol (`IAuthorization`), using Datomic as a backing graph store. So you can add sophisticated authorization to your Clojure project on day one and migrate to SpiceDB later. Internally, EACL recursively traverses the permission graph using direct index-based calls (via `datomic.api/index-range`) to efficiently answer `CheckPermission`, `LookupSubjects` and `LookupResources` queries. The goal for EACL is to provide best-in-class authorization for Clojure & Datomic applications with <10M entities. It is especially suited to Electric Clojure[^3]. EACL has been open-sourced under the AGPL, but we are likely to relicense it under a more permissive licence. EACL is used at CloudAfrica, a regional cloud host based in South Africa. [^1]: https://cloudafrica.net [^2]: https://authzed.com/spicedb [^3]: https://electric.hyperfiddle.net/

aring between these instances and factorize further. We envision doing joins potentially over dozens of distributed Datahike instances in a global address space during single queries. Since the indices are amortized data structures it does not make too much sense to encrypt chunks of them for different users as this defeats the optimality guarantees of B+-trees, i.e. you could have very bad scan behaviour over huge ranges of encrypted Datoms. How have you tried to partition the data? This is an interesting problem. We can also expose the datahike-server query endpoint directly and you can write static checks for access right restrictions. We only do this so far to limit the usage of builtin functions to safe ones, but you could also go ahead and do the same for more complex access controls. Some work in this direction for Datahike has also been done here: https://github.com/theronic/eacl Doing this openly on the internet will also require a resource model to fend of denial of service attacks, fortunately Datalog engines can have powerful query planners and we can restrict our runtime to limited budgets as well.