 |
This slide shows how authorization data is actually represented in Zanzibar-style systems.
Instead of storing permissions in tables or role lists, everything is stored as tuples of the form — (object, relation, user). These tuples form a directed graph, often a DAG.
For example, we might store relationships like:
Teacher is editor of marks card
Teacher is reader of homework
Student is editor of homework
Student is reader of marks card
Each of these is just an edge in the graph. Nodes are users and resources, and edges are relationships like reader or editor.
When a permission check happens — like ¡®Can the teacher edit the marks card?¡¯ — the system doesn¡¯t look up a role. It performs a reachability check in the graph following these relationships.
This graph-based representation is what allows Zanzibar to model complex hierarchies, inheritance, and nested permissions in a scalable way.¡± |
IEEE/ICACT20260076 Slide.05
[Big Slide]
[YouTube]