First thing, we want to share *why* we are doing this and set some expectations.
Thread 👇
2/ Building new products is a messy process. There is no manual. But one thing we know is if we focus on learning and iterating, we can get somewhere. Worst case we learn that an idea is not worth it, the best case we find a product. Either case we learn.
3/ This is an experiment 🧪. We've never done this before.
Auth0 has a mature and defined prod dev process. We are a small team focusing on exploring product adjacencies and that gives us room to be more experimental.
Bear with us and embrace experimentation.
4/ Having said this, we have two goals:
1️⃣ Learn from the community
Learn about the *problem*: challenges, annoyances, specific use cases, how you articulate it, what resonates.
Learn about the *solution*: whatever we build, how we tell the story. We want to get feedback.
5/ 2️⃣ Give back by sharing our thought process
We think there is value in sharing our thought process. For those who never built a product, or the ones curious about how we approach it, it might sparkle some ideas. It also gives us skin in the game.
6/ This will be another input for us, like speaking to customers is.
In the next few weeks, we will be focusing on the problem. We will share tomorrow the area we are diving into and start posting about our research.
We'll go over what is currently being addressed and what the gaps are👇
2/
As we've mentioned before, solving #fgaatscale requires:
1️⃣ Permission modelling flexibility
2️⃣ Auditing capabilities
3️⃣ Correctness: no invalid permissions are granted
4️⃣ Low Latency
5️⃣ High availability
3/ Solving #fgaatscale is becoming a need because:
☝️ Users expect collaboration features in most products they used, and that requires FGA
✌️ Increasing privacy and compliance regulations require companies in different verticals to restrict access as much as possible
3/ Like github, @googledrive has B2C and B2B models. However, @googledrive's sharing model is the same for B2C and B2B. The difference is who you can share files with.
In this thread explore we'll the problems of authorization at scale using a real world, well known example
2/ This is a key part of product development, especially when building infrastructure. We want to understand what our customers will eventually build with our service.
We also promised to unveil this week the problem we want to dive into 🥁...
2/ The area we'd like to explore is: *fine-grained authorization*
Why this? And why now?👇
3/ Large scale fine-grained authorization as a building block is an unsolved problem. Just like authentication was ~8 years ago. We implement it in every app we build, over and over. There is no generic, cross-platform, cross-domain solution.