Senior LevelAuthentication & Authorization
How does Google Zanzibar achieve global consistency and microsecond authorization checks using Zookies?
❓ Interview Prompt: Explain Google Zanzibar architecture, global relation tuple evaluation, snapshot consistency, Zookie tokens, and Spanner TrueTime.
Google Zanzibar is a globally distributed authorization system storing trillions of relationship tuples and processing millions of authorization checks per second with sub-10ms latency.
The Stale Read Problem in Global Authorization:
If an owner revokes Alice's access on a database node in New York, a read request on a replica node in Tokyo might still allow Alice access if replication lags (the "New-Enemy Problem").
How Zookies and TrueTime Solve This:
1
Zookies (Zanzibar Cookies): Opaque consistency tokens returned during authorization mutations containing a TrueTime snapshot timestamp.
2
Snapshot Consistency: When checking authorization, clients present the Zookie. Database replicas check tuple relationships at an exact historical TrueTime snapshot, guaranteeing that permission checks never evaluate stale ACL state!
Code Implementation Example
typescript
// Zanzibar Authorization Check with Snapshot Zookie Token
interface ZanzibarCheckRequest {
object: string; // "doc:readme.md"
relation: string; // "viewer"
user: string; // "user:alice"
zookie: string; // Opaque snapshot timestamp token e.g. "zk_1770042819"
}
async function checkZanzibarPermission(req: ZanzibarCheckRequest): Promise<boolean> {
// Query database snapshot at exact Zookie TrueTime timestamp
const tuples = await zanzibarStore.getTuplesAtTimestamp(req.object, req.zookie);
return evaluateRelationshipGraph(tuples, req.user, req.relation);
}💡Zanzibar authorization check presenting snapshot Zookie token for consistent reads.
🎯 Interview Key Takeaway
Google Zanzibar uses snapshot Zookie tokens to guarantee globally consistent authorization reads without stale ACL latency.
#Zanzibar#Zookie#ReBAC#Global Consistency#Senior
Back to all Authentication & Authorization Questions→