What I’m up to right now
Three months since the last update. Not because nothing happened — because a lot did, and none of it was at a good stopping point to write about. May, June, July went into work and into one topic I did not expect to swallow a quarter: authorization.
SpiceDB and ReBAC
I went in thinking permissions were a solved problem. Add a role, check the role, move on. That holds until someone asks a question like “can this user see this specific record, because of who they’re related to, three hops away” — and then role checks fall apart, and you end up writing the same subtle query in fifteen places.
SpiceDB is built on the Zanzibar model, which is Google’s answer to that: store relationships, not roles, and ask the permission system a question instead of assembling the answer yourself in application code. Relationship-based access control. document:readme#viewer@user:mangesh, and the interesting part is what it can infer from there.
What I’ve actually been doing is writing schemas, realising they’re wrong, and rewriting them. Getting the model right is most of the work. The query part is easy once the relationships are honest.
The part that took the longest to click is consistency. Distributed permission checks have a real tension between “fast” and “correct immediately after a write,” and Zanzibar’s answer to that — zookies, snapshot reads, choosing a consistency level per call — is a whole subject of its own. I can reason about it and build against it on my own now, which is the bar I was aiming for this quarter.
Keycloak
The other half. Keycloak handles who you are; SpiceDB handles what you can touch. Keeping those separate is the point, and it took me a while to stop trying to make one of them do the other’s job.
Realms, clients, scopes, token exchange, mapping claims to something an application can use without leaking the identity provider’s shape into everything downstream. A lot of it is configuration rather than code, which I found harder, not easier — there are fewer places to put a comment explaining why.
Systems and scaling
Underneath both of those, the thing I actually wanted this quarter: depth instead of breadth. Not another framework. Understanding where reads go, what a cache invalidation costs, which failure happens first when traffic goes up, and why the answer is so often “the database, and later than you think.”
Honest status
Still carrying the rule from April: ship the bad version. There were fewer of them this quarter because the reading had to come first. That part is done, so the building starts again.