How we rebuilt complex permissions without migrating to Zanzibar
summary
Infisical implemented folder-based access control to solve the limitations of traditional Role-Based Access Control (RBAC), which often struggles with edge cases where users need specific additions or subtractions of privileges. By introducing a layered permission system where folder-specific grants supersede general roles, they provided a more intuitive user experience without migrating to a complex Zanzibar-style architecture. This approach allows for precise security postures while maintaining compatibility with existing legacy permissions and open-source self-hosted instances.
key points
- Conventional RBAC is insufficient for specialists who need narrow additions or subtractions of access, often leading to the creation of redundant custom roles or overly broad permissions.
- The technical implementation uses a two-layer logic where a global 'deny' block for a specific folder is applied first, followed by a specific 'allow' grant, ensuring folder-level settings always override inherited roles.
- To solve the cache invalidation problem caused by folder renames and moves, the team implemented a project-wide version counter that triggers a fingerprint update upon any write operation.
who should read it
Software engineers and architects tasked with building or scaling authorization systems, particularly those managing complex permission hierarchies in enterprise software.
discussion positive
consensus
Commenters generally agree that implementing authorization is a necessary but unglamorous task that often starts with custom, database-driven solutions. There is a shared understanding that avoiding external dependencies is critical for on-premises enterprise software. While some users question the specific data model, the overall sentiment is supportive of the engineering trade-offs made to avoid operational complexity for customers.
top insight
The most valuable perspective is the trade-off regarding tooling; dedicated authorization systems provide debugging and correctness-proving toolchains that homegrown solutions typically lack. This suggests that the long-term cost of a custom system is not just maintenance, but the absence of CI/CD integrated validation tools. Such a gap becomes critical as the system scales or the original architects leave.
Generated by an LLM from the article and thread. Check the sources before relying on it.