That means it will have to scan all docs and perform check requests on all of them. So in this weird case, wouldn’t it be pretty bad?

From what I’ve seen if this works as expected it’s a killer feature in my opinion.

yes, that's why we built Materialize; for the worst case

definitely does. if you're interested, please sign up on the early access waitlist. we're working with a select set of customers with it now

Thanks for all the information. Well currently I am at an Investment firm, and we have scaling issues because we do auth at the DB and the logic is quite complex. So I’ve looked into Zanzibar and from all the products that are out there you are the only ones that might solve our issue. We are not yet using your platform, but If I manage to convince the leadership, we will need to try this out first.

BulkCheckPermission is squarely in the center of use cases that SpiceDB is optimized for

Out of curiosity, what are you using for this site? https://zanzibar.tech/

intersting, will this available in the self-hosted option as spicedb or only in your cloud based offer?

it will eventually be available on prem, but still paid

do you guys have white paper or plan to, describing a bit more the solution?

right now we're working with early access customers on it so no public docs yet, but we can discuss details if you're interested

yes interested. we have a search use case that can return quite a few results for which we use ElasticSearch and planning on using SpiceDB self hosted for pemissions. We have come up with a solution that returns fewer results from SpiceDB, because we can make some assunptions around our model and I think we will go with that for now but would be interested in exploring other options.

feel free to schedule a call with us and we can discuss: https://authzed.com/contact

It's mentioned in the annotated Zanzibar paper that the existing capabilites of Spanner likely influenced the design of Zanzibar. Since SpiceDB is based on Zanzibar, does that mean SpiceDB would run most efficiently on Spanner? Is there more latency on CockroachDB or Postgres since they have to approximate the abilities of Spanner?

not that i'm aware of. the big thing that spanner gives you that zanzibar uses is the ability to kind-of-linearize transactions in a distributed system using its TrueTime API. you only have that problem in a distributed system, so you don't see it in postgres or mysql at all. cockroach solves it a different way - they've got a pretty good writeup of it here: https://www.cockroachlabs.com/blog/living-without-atomic-clocks/, and to my knowledge there isn't a meaningful performance difference between spanner and cockroach. i'd let the devs weigh in there though.

If you care about the new enemy problem, CRDB requires us to do some extra work when writing that impacts the write performance throughput vs Spanner. If you don't, then the differences should be fairly minimal

"care about the new enemy problem" == using

at_least_as_fresh

consistency instead of

minimize_latency

?

thanks for linking that, that was a cool read

and requiring that a user's access cannot change at a point-in-time, no matter what

The zanzibar literature makes a big point about reverse indexing, but as far as I can tell the paper doesn't actually describe an API that leverages that. Expand is the same direction as "check" (object to user). What was Zanzibar's "reverse" API? Did they have a "reverse expand"?

Hi y'all, is there any good resources for a CTO kind of role ?

TIL Zanzibar was named so because it's "one of the spice islands": https://www.osohq.com/post/developer-den-with-lea-kissner Here I was thinking they let go of an awesome name, but it's been right there the whole time!

it was known as "Spice" internally

ah, the article says that 🙂

Something I'm struggling to understand is this quote from the Zanzibar paper (https://zanzibar.tech/2L8muxKlMv:u:1_), which an Authzed annotation pointed out (https://zanzibar.tech/#annotations/intro/surprising-reads-qps): > Several Zanzibar clients also use Zanzibar to store their social graphs. As in, certain Google services are using Zanzibar as their actual data store for their entire social networks, which is backed by the fact that there are twice as many Read requests to Zanzibar as there are Check requests. So those relationships aren't actually stored in the app, or metadata, store. So how might these services do something like paging, where pages are often sorted by most recently created/edited? For example, if you wanted the first page of the 25 most recently created resources, you would have to request every possible resource ID from Zanzibar, just so you could take it back to the metadata store and figure out which of those are the 25 most recent. If you ask for any less than everything from Zanzibar, you risk missing the most recent resources

We can only guess at things they didn't write about, but they talk about applications using the Watch api to maintain secondary indexes of data in Zanzibar. My guess is that the applications storing their social graph in Zanzibar either intentionally avoid sorting by the graph in the way you're asking about, or maintain their own secondary index even though the primary data is in Zanzibar alone.

Ah okay that's a pretty good note – just because Zanzibar is their primary data store doesn't mean it's their only data store. Thanks!

I'm trying to use SpiceDB in a similar way, and while I'm not at the scale where that question applies to me, it's important to me that the problem at least has some solution. Google of all places must have found one

hello everyone, I'm here from the annotated paper (zanzibar.tech). I'm trying to grok the Leopard Indexing System section. Here's my understanding, please correct me if I am wrong: -

Member2Group(U)

returns all the groups for which U is a direct member -

Group2Group(G)

returns all the descendants of group G - These groups are implemented using data structures optimized for set operations - If the intersection of the results from Member2Group and Group2Group is non-empty, then U is a member of G - Though not explicitly stated in the paper, a tree is used to map Parent groups to child groups (so as to enumerate all the descendants)

Also on a separate note, what does it mean for

#...

to not affect the semantics of a tuple, e.g. given

folder:A#...

, is this like a wildcard?