Top all-time · #2067
AuthZed
Company blog · authzed.com/blog · on HN as jzelinskiesecuritydata
AuthZed is the company blog at authzed.com, writing about security and data. Since 2021, 35 different Hacker News readers have linked it 113 times, most often “The Annotated Google Zanzibar Paper”. It is still writing: the last post was on 2026-10-28, and you can follow it by feed.
Rarely recommended · 1 of 30 sampled comments recommend it?
Why HN links it
HN readers link AuthZed's site and blog for explainers on Google Zanzibar-style permissions and its SpiceDB product, including lookup APIs and a list of competing implementations.
- Recommended for · 1 comments
- One commenter called the articles on Zanzibar-style authorization interesting.
Summarised by Claude from a sample of 30 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Remove authorization bottlenecks, empower your team to innovate and expand with best-in-class performance at any scale.
Most-linked posts?
- /blog/what-is-zanzibar/4 people · 9 mentions · first linked 2021-06-08
- The Annotated Google Zanzibar Paper4 people · 5 mentions · first linked 2022-12-08
- /4 people · 4 mentions · first linked 2021-08-05
- /blog/acl-filtering-in-authzed/3 people · 5 mentions · first linked 2021-06-24
- /3 people · 4 mentions · first linked 2021-04-08
- Onboarding with an M13 people · 3 mentions · first linked 2021-04-07
- The One Crucial Difference Between Spanner and CockroachDB3 people · 3 mentions · first linked 2021-10-14
- Maximizing CockroachDB Performance: Our Journey to 1M QPS2 people · 3 mentions · first linked 2023-06-07
- New Enemies2 people · 3 mentions · first linked 2021-05-20
- A Primer on Modern Enterprise Authorization Systems2 people · 2 mentions · first linked 2023-09-14
What Hacker News says?
Full disclosure: I'm an Authzed founder. Our SaaS product is serverless, but we also offer on-prem support which is easy to get started with as the core database is entirely open source[0]. Feel free to hack around with it and drop into our community Discord[1] [0]: https://github.com/authzed/spicedb [1]: https://authzed.com/discord
Comment linking /discord
on “Ask HN: Who wants to collaborate?”Submitted SpiceDB Is Open Source as a story · 196 points
HN discussionHave you seen https://authzed.com/ ? I know it's not what you are saying but seems relevant if you haven't already seen it. I think there is a ton of room for new players in the authn and authz markets. I like how narrow you are focused.
Comment linking /
on “Ask HN: Who wants to collaborate?”Submitted Onboarding with an M1 as a story · 165 points
HN discussionNot to be confused with SpiceDB by AuthZed: https://authzed.com/spicedb
Comment linking /spicedb
on “Spice: Fine-grained parallelism with sub-nanosecond overhead in Zig”Submitted Dropping playground latency by porting SpiceDB to WASM as a story · 71 points
HN discussion"Can I [action]?" is the exact question that Zanzibar[0] was designed to answer in a highly performant and scalable way. With multiple data sources reading and writing to SpiceDB [1] (our OSS implementation of Zanzibar), those questions can further be extended into "Can [subject] [action] on [resource]", which allows for supporting not just permissions, but (as you suggested) feature flags, entitlements, role-based…
Comment linking /docs/spicedb/concepts/caveats
on “Pains of building your own billing system”Submitted Maintaining a Stable Protobuf API as a story · 18 points
HN discussionAuthzed (YC W21) | Senior Site-Reliability Engineer (SRE) | NYC, Remote USA | Full-Time | https://authzed.com/ 20 milliseconds at the 99.5 percentile and five-nines (99.999) of uptime. Those are our goals for our globally-distributed permissions system as a service. If you’re interested in helping us achieve these goals, we would like to talk. We’re currently using best-in-class open source solutions on the public c…
Comment linking /
on “Ask HN: Who is hiring? (February 2022)”Submitted Show HN: A kids book that introduces authorization and permissions concepts as a story · 11 points
HN discussionThe permissions service at Google. For more details see: https://authzed.com/blog/what-is-zanzibar/
Comment linking /blog/what-is-zanzibar/
on ““Older unlisted videos will be made private unless you opt out””Submitted Caveats: A Scalable Solution for Policy as a story · 9 points
HN discussionHi Nick, In the case of Authzed, we provide a gRPC API [0] which can be used from any application or language that supports gRPC, as well as designed client libraries for specific languages [1] to make integration even easier. Applications primarily integrate by making Check requests [2] at any point in which a protected resource is being accessed and Write requests [3] at any point in which permissions are granted…
Comment linking /
on “Ory Keto, open source authorization server based on Google Zanzibar”Submitted Getting Database Connection Draining Right as a story · 8 points
HN discussionIt's a really well designed distributed system for calculating access control decisions at scale. It makes a specific authorization CAP tradeoff that allows for consistency around access checks to different "versions" of a piece of content, allowing older content to be protected by checks served from read replicas and cache. Full disclosure: I am a co-founder of a company building and hosting a Zanzibar implementati…
Comment linking /
on “Ory Keto, open source authorization server based on Google Zanzibar”Submitted Commonly-held opinion is wrong, but read on to discover it's mostly right as a story · 8 points
HN discussionI don't work at ORY, but I do work on a Zanzibar implementation. Basically, what you're describing is called "GBAC". GBAC can be great if you need the full power of a typical Graph API, but Zanzibar-like services are focused on solving the problem of finding a path between two edges[1] and doing everything you can to optimize that operation for latency. GBAC is flexible, but at the cost of performance compared to so…
Comment linking /blog/identity-isnt-the-foundation/
on “Ory Keto, open source authorization server based on Google Zanzibar”Submitted Online Schema Migrations in SpiceDB as a story · 8 points
HN discussionWent through the same process except with an M1 Macbook Pro. My coworkers volunteered me to see if we could get our dev stack building and running on ARM with hopes they could eventually dump their older x86 Macbook Pros, which run loud and hot. It was a bit of a process but once we got it working, developing on the M1 has been great. Captured notes on the process here in case it's helpful for anyone later: https://…
Comment linking /blog/onboarding-with-an-m1/
on “Docker Desktop for Mac (Apple Silicon)”Submitted The Day Benjamin Franklin Broke Our CI as a story · 6 points
HN discussion>But authz is far more complicated, since it requires an ACL list of arbitrary length along with the token. It’s not like GitHub can stuff a list of every repository I can access into my access token. This is exactly the problem that Zanzibar solves that makes it exciting! I've written about why giant lists of claims are not a good way to structure permission systems[0] and Zanzibar-inspired services do not function…
Comment linking /blog/identity-isnt-the-foundation/
on “Zanzibar: Google’s Consistent, Global Authorization System (2019)”Submitted The Annotated Google Zanzibar Paper as a story · 6 points
HN discussionA Zanzibar-style service does not need _every_ object from your DB replicated into it, but only the relationships between the objects that matter for authorizing access. Many of these relationships require little/no metadata in your DB so they can live _solely_ in Zanzibar rather than being in both your DB and Zanzibar. This is pretty great because when permissions requirements change, you can often address them by…
Comment linking /
on “Zanzibar: Google’s Consistent, Global Authorization System (2019)”Submitted Open sourcing the SpiceDB Playground: model authz in-browser, powered by WASM as a story · 5 points
HN discussionIt is actually slightly worse than even that: while New Enemy [1] is the primary concern, caching like this can also introduce a staleness issue from the other direction: let's say a user adds a new row or document, and immediately sends the link to their coworker... who tries to load that piece of data, but the (stale) access control dataset is cached and they are not in it... they get a "no access" error. While ce…
Comment linking /docs/authzed/concepts/authzed-materialize
on “I built a faster Notion in Rust”Submitted Authzed Joins the CNCF as a story · 5 points
HN discussionThis is a pretty good analysis of the situation I think. The only thing that I would like to point out is that only a description of the API is available via the Zanzibar paper. We, and other clean-room implementations, have had to fill in the gaps around what the APIs actually look like. We've even made some of our own improvements such as resource lookup by subject[0] and a filter-based delete that mirrors the rea…
Comment linking /blog/acl-filtering-in-authzed/
on “SpiceDB Is Open Source”Submitted AuthZed has secured $12M of Series A fundraising as a story · 4 points
HN discussionThere are a variety of synchronization methods, and the choice of which is very application specific. The simplest choice to get started with is to add it directly to your application logic. The main pro of this solution is that you can directly handle the semantics of when and how to add/remove permissions. For example, it's sometimes safe and idempotent to write permissions for data that may fail to commit, becaus…
Comment linking /blog/new-enemies/
on “SpiceDB Is Open Source”Submitted Using GitHub to manage your first CVE as a story · 4 points
HN discussion
