Zanzibar: Google’s Consistent, Global Authorization System
📜 Abstract
Determining whether online users are authorized to access digital objects is central to preserving privacy. This paper presents the design, implementation, and deployment of Zanzibar, a global system for storing and evaluating access control lists. Zanzibar provides a uniform data model and configuration language for expressing a wide range of access control policies from hundreds of client services at Google, including Calendar, Cloud, Drive, Maps, Photos, and YouTube. Its authorization decisions respect causal ordering of user actions and thus provide external consistency amid changes to access control lists and object contents. Zanzibar scales to trillions of access control lists and millions of authorization requests per second to support services used by billions of people. It has maintained 95th-percentile latency of less than 10 milliseconds and availability of greater than 99.999% over 3 years of production use.
✨ Summary
The paper documents Zanzibar, Google’s unified authorization service for storing permissions and evaluating access-control decisions across many products. Its central abstraction is a set of relation tuples connecting users, groups, and objects. A configuration language expresses derived relationships and policies using operations such as union, intersection, exclusion, and inheritance through object relationships. This enables policies ranging from direct sharing to nested group membership and permissions inherited from parent resources.
A major contribution is the treatment of authorization consistency as a distributed-systems problem. Zanzibar uses externally consistent timestamps backed by Spanner and opaque consistency tokens called “zookies” to ensure that authorization checks observe ACL changes and content updates in causal order. This prevents stale permissions from being applied to newer content and avoids the paper’s “new enemy” problem. The service uses replicated storage, recursive request fan-out, caching, request deduplication, hedging, and performance-isolation mechanisms to meet demanding latency, availability, and scale requirements. The reported deployment handled more than two trillion ACLs and millions of authorization checks per second, with 95th-percentile latency below 10 milliseconds and availability above 99.999% over three years of production operation. (storage.googleapis.com)
The paper has had clear subsequent influence on authorization infrastructure. OpenFGA explicitly identifies Zanzibar as its inspiration and implements the core operations and relationship-oriented modeling approach in an open-source system intended for general application use. (openfga.dev) SpiceDB likewise describes itself as an open-source, Zanzibar-inspired authorization database and identifies the paper as the original source of its design direction. (github.com) These projects helped transfer Zanzibar’s tuple-based, relationship-oriented authorization model from Google’s proprietary infrastructure into deployable systems for broader industry use. The available evidence supports influence on subsequent authorization-system design and tooling; it does not establish that every feature or implementation detail of those systems matches Google’s production architecture.