 |
As Google¡¯s products grew — Drive, YouTube, Maps, Cloud, Photos, Calendar — each system originally handled permissions in its own way. That led to duplication, inconsistency, and difficulty enforcing security at scale.
Zanzibar was created as a single source of truth for authorization. Instead of every product answering permission questions differently, they all ask one central system questions like ¡®Can Alice view video X?¡¯ or ¡®Can Bob create a VM in this cloud project?¡¯
Technically, Zanzibar is built on Spanner, Google¡¯s globally distributed database. That gives it strong consistency, global replication, and the ability to serve permission checks reliably across data centers.
The key idea is that authorization becomes an infrastructure service, just like storage or networking. Products don¡¯t implement their own access control logic — they delegate it to Zanzibar.
And the last point is the fun one: you¡¯ve probably used Zanzibar recently without realizing it — anytime you shared a Google Doc, watched a private YouTube video, or accessed a cloud resource, a Zanzibar permission check likely happened behind the scenes |
IEEE/ICACT20260076 Slide.04
[Big Slide]
[YouTube]