Thread by @Auth0Lab

1/ We've analyzed the #fgaatscale problem:

https://twitter.com/Auth0Lab/status/1326240848170848257?s=20

We've shared our view on the market:

https://twitter.com/Auth0Lab/status/1326606867993391115?s=20

It's time to tell you what we are planning to build 🥁... 🧵

2/ Project #sandcastle will be a globally distributed, highly reliable service for large scale, fine grained authorization.

It's based on @Google's Zanzibar paper: research.google/pubs/pub48190/, that powers #fgaatscale for @googledrive @googlecloud @YouTube and @Google other products!

3/ You'd:
1. Sign up for a subscription
2. Configure who has access to what
3. Pick an SDK for your favorite language/tool
4. (optionally) Feed your authZ data from existing sources into #sandcastle

That's the ideal future. At this point you'd have AuthZ for your app 🤯

4/ 📈 As your app grows, you wouldn't need to worry about AuthZ growing with you!

🤝 If you are using @auth0 for AuthN, it'd make your life even easier, but #sandcastle should be usable independently.

5/ 🎁 What'd be in the box?
🌎 Global: HA + low latency
📡 HTTP API to write permissions and check access
🛠 SDKs for languages and policy solutions e.g.: @OpenPolicyAgent
🔌 Plugins for @apachekafka, @PostgreSQL, etc. to feed data into #sandcastle
📜 Audit

We'd ❤️ feedback

6/ 🤔 How do we think it'll be used?
Either as a PDP or a very large PIP.

PDP mode works for many permission models and new deployments.

PIP mode will be used for migrations, and decisions that need global and local context.

cheatsheetseries.owasp.org/cheatsheets/Mi…

7/ What are our big open questions so far❓

⏱Latency
- How low does it need to be?
- What's the ideal consistency/latency tradeoff? Tunable?

☁️ Deployment
- SaaS only
- SaaS + "caches at customer edge"
- Marketplace add-on per cloud

We'd love your help answering those 🙏

8/ If you are exploring this problem space, reach out. We'd love to learn about what you are doing.

🗞 And leep an eye on the account for more news...

<end thread>