Welcome to the SpiceDB Field Resource Center from AuthZed
This site explains Google Zanzibar–inspired relationship-based authorization (ReBAC) with working demos you can open in a browser — real schemas, real relationships, and a visible answer to every check. Nothing to install, and nothing to sign up for.
Three in about eight minutes, in this order. Everything else assumes these.
In 2019 Google published a paper describing Zanzibar, the system that answers permission questions for Drive, YouTube, Calendar and much of the rest of Google. Its idea is simple: store relationships — this person is an editor of that document — and compute permissions from them on request, rather than keeping a table of who can do what.
SpiceDB is an open-source database built on that model. You write a schema describing your objects and the rules between them, write relationships as things happen in your product, and ask it one question per request: can this subject do this thing to this resource?
AuthZed created SpiceDB and maintains it in the open. We also run it as a managed service for teams who would rather not operate a database that sits in front of every request. The schema language, the consistency model and the APIs shown here are all in the open-source project.
Roles work well until access starts depending on which object is being asked about — a document shared with one person, a matter with a conflict wall, a payment the creator must not approve. That is the point where a role table starts encoding objects into role names, and where this model is worth the change. If your objects are a fixed set and nobody shares individual items, a role table is simpler and you should keep it.
SpiceDB Demonstrations
Interactive demos you can open in a browser. Nothing to install. Grouped by what they are for — the first group is the place to start.
Start here
The idea, and where it came from.
From RBAC to ReBAC
The difference is one more column in what gets stored. Three escalating requirements show where it starts to matter. 3 min narrated · 2×
The Zanzibar paper, explained
Eight interactive sections on Google’s 2019 paper — relation tuples, userset rewrites, check evaluation, Expand, zookies, Leopard, hot spots and the reported scale.
8 min narrated · 2×SpiceDB and the Zanzibar paper
Every concept in the paper, and what SpiceDB calls it — relationships, schema, ZedTokens, Materialize — plus what SpiceDB adds, and what it does not claim.
9 min narrated · 2×The hard problems
The failures that are difficult to see until they bite.
The new enemy problem
Access is removed, the document changes, and a replica that has seen neither answers the check. 3 min narrated · 2×
Three apps, one rule
Starts with the picture, then proves it: one policy implemented three times, in three languages, giving three different answers — until you switch to one service.
9 min narrated · 2×The dual-write problem
One handler, two systems, no transaction across both. Crash it at each point and see which one leaves them disagreeing. 2 min narrated
How it works
The mechanics, shown rather than described.
Composable schemas
Three teams, three files, one deployed schema. Watch a team adopt a shared shape by adding a single line to their own file. 2 min narrated
The Watch API
A cached allow that outlives the permission behind it — and the stream that closes the gap. 2 min narrated · 2×
How a CRM writes to SpiceDB
Six steps through a single save: the CRM stores its own record, then sends SpiceDB the one relationship that changed. 3 min interactive
In practice
What it looks like inside a product, and what it costs.
Multi-tenant SaaS
Isolation is the easy half. The person in two tenants, the consultant across all of them, the auditor in none. 2 min narrated · 2×
Authorization challenges grow over the product lifecycle
Five stages from ten users to AI agents, walked twice — once building it yourself, once with AuthZed. 3 min narrated · two paths
Build vs buy calculator
Pick what you'd actually build, set your team and rates, and see the three-year cost of each path. 5 min interactive
Play it
Grant exactly what the ticket asked for, and nothing more.
The Access Request
A game. Three tickets arrive and you grant the access. More than one grant satisfies each request — only one leaves everything else closed.
Intro + 3 tickets · 5 minIndustry Demonstrations
Working applications, each with its own authorization model. Every row, balance and document is a separate permission check.
FinCore — financial platform
Separation of duties expressed as an exclusion, and approval limits as caveats that carry the payment amount as request context. Eight scenarios.
LexFlow — legal platform
Matters, ethical walls, privilege and outside counsel. The wall is an exclusion, so it denies someone who genuinely qualifies. Six scenarios.
PeopleOS — HR platform
A multi-tenant HR product where every row, field and panel is its own permission check — including the manager who opens a profile and is denied the salary. Five scenarios.
Orbit — a B2B project platform
Workspaces, teams and projects across several enterprise customers. An outside consultant gets one project and nothing else; a customer admin gets their whole account and no one else’s. Five scenarios.
Lumen — an enterprise AI assistant
The same question, asked by four people, answered from different sources. Retrieval is filtered by permission before anything reaches the model. Five scenarios.
CareMesh — a patient record platform
Two doctors at the same hospital with different access to the same patient, because only one is on the care team. Administer and read are separate. Six scenarios.
Stratum — a data platform
Datasets, reports and groups. A partner gets one dataset and its approved report without the warehouse behind it, and the arrow only points one way. Five scenarios.
Keel — an internal developer platform
Deploy is an intersection: on the team and on the approval list. Staging on one service never implies production on another. Break-glass reads and cannot deploy. Six scenarios.
Personas and Teams
Who authorization affects, and what each of them cares about. The CISO page is a working demo; the rest are overviews.
The CISO
Blast radius per account, computed. Least privilege, AI agents, revocation and the access review — plus five things it does not do.
4 min narrated · 2×Engineering
Stop maintaining permission logic scattered across services. One schema, one API call, one engine.
Product
Ship the sharing, roles and collaboration features customers keep asking for, without a rebuild each time.
Security
Access sprawl, instant revocation, and a straight answer to who can reach what.
Whitepapers
Longer reading, for when the demo has done its job.
AuthZed Dedicated — what you get
The fourteen capabilities Dedicated adds on top of Self-Hosted — each with what it is, how it helps and where the saving is — plus the support tiers.
One page · 14 capabilities + supportThe Case for Centralized Authorization
Three services, one rule, three answers. What scattered authorization costs, what moves when the decision is centralized, and where to start without migrating everything.
PDF · 5 pagesOne schema file is fine. Until three teams own it.
Splitting a schema into files with owners, sharing the common shapes as partials, and what composition does — and does not — fix.
PDF · 4 pagesBuild great features. Not authorization.
Where the cost of a homemade authorization engine actually sits, what centralizing does and does not change, and a three-year model you can run with your own numbers.
PDF · 4 pagesBuilding a multi-tenant SaaS authorization system
Isolation, teams, roles, delegated admin, cross-tenant sharing, support access and temporary permissions — in one model.
Authorization after an acquisition
The permissions merge is usually what holds up the integration. How a relationship layer lets you stop waiting for it.
SpiceDB Enterprise Benefits over Open Source
Five capabilities a commercial licence adds around the engine — audit logging, the security embargo, restricted API access, rate limiting and a support relationship. Open source is a production-grade authorization engine; these sit around it.
The summary
Seven slides, one per capability.
Benefits summary · slides
A cover, one slide for each of the five with what open source lacks and what it means in practice, and a closing summary. Opens as a PDF in the browser.
PDF · 7 slides Download the editable PowerPoint