System Design · Snowflake · Hard
Requirements A separate service calls the ACL service synchronously before it performs any protected operation. Request: (subject_id, resource_id, action). Response: allow deny, with an optional audit-friendly explanation. Authorization policies must handle both explicit permissions (subject → resource → action) and permissions inherited through groups and roles (subject ∈ group ∈ role → resource → action). The p99 response-time target is only a few milliseconds, since each…
Checking your access…