Design Role-Based Access Control
MediumSystem design · Security · SalesForce
Design an authorization service for a multi-product company. It stores users, groups, roles and resource-level grants (project, folder, document) with inheritance, and answers 'can user X do Y on resource Z' for every request across many services, plus 'what can X access' listings. Focus on the data model (relationship tuples), fast checks with caching, revocation timing, consistency and auditing. Out of scope: authentication and session handling.
Requirements
- Support groups, roles, resource hierarchies and inheritance (folder to document)
- Keep checks fast and safe: local evaluation or caching with a bounded staleness; deny by default
- Provide consistency tokens so a service that just changed a permission sees its own change
- Audit every grant and revoke; support efficient 'list what this user can access' queries