AuthZed

“The implementation itself was rather straightforward,” Derek noted. “The initial planning took about one or two months due to the legacy code we had to address. We structured things so that new clients could adopt the SpiceDB solution right away, allowing us to give some clients access within three months. We went into full production within five months.”

“It was a cost-benefit analysis. At the time, we were a startup with a small staff and deadlines to hit, and we wanted to move quickly. It just made sense to use AuthZed Dedicated. We were also impressed with AuthZed’s disaster recovery plans and security stance. We spend a lot of time thinking about those things because we’re in the legal space, and for every question we asked, AuthZed had an answer. They already had solutions and procedures in place, so we were comfortable with AuthZed hosting SpiceDB.”

“SpiceDB came up early in our search,” Derek shared. “There were a few things that were really compelling. I loved having the playground to test things out; it was fun to work with. We also really liked the way you define your schema with SpiceDB. We looked at other options, but their schema designs didn’t work the same way. None of them were actually competing in this space, in my opinion.”

“Once we identified the problem, we realized building authorization ourselves wasn't practical. We were hitting system limits, and it was becoming increasingly difficult to manage. We needed to focus on our legal products, not authorization. That's when we decided to look for existing solutions.”

“"Here’s authorization. You don’t need to build anything else — you just need to talk to it."”

““What brought me over to SpiceDB was the documentation and the playground. When you’re introducing something that’s, in hindsight, so simple, yet appears complex when you first come across it, being able to show how it works in real-time with the playground is genius.””

“"If you look at the latencies, [...] the 99th percentile are all under 15 milliseconds in the worst case. Everything is just very, very impressive from anywhere you look at it. The vast majority of our calls are all within 3ms for check permission. Everything looks just fantastic.””

““The customer success team is fantastic. I have only praise to give them… They've always been very responsive.“”

“"We have an API used by every single customer on every app in the Turo platform. I had a rough idea of the level of traffic, but I didn't know exactly what it was or how we'd ramp up to that traffic. The fact that SpiceDB took in that intense traffic without any problems made me feel a lot easier with my decision to use this technology."”

““Our metrics of success are about adoption,” said Lee Power. “SpiceDB Enterprise is the underlying technology behind the features we present within the application. Nearly every one of our customers using the platform has asked for what we’ve built with project roles and environment permissions.””

“AuthZed significantly simplifies our permissions management effort and reduces ongoing operational overhead.”

“AuthZed simplifies our permissions management effort and makes managing various third-party permissions so much easier.”

“AuthZed was there whenever we needed support. The team helped us optimize performance, scale the system, and develop better solutions quickly. The dedicated schema review was especially valuable because once the schema and framework are in place, the remaining development work becomes much simpler.”

“AuthZed stood out for its depth of technical understanding. Its annotated version of the Zanzibar paper demonstrated a serious engagement with the architectural challenges of building authorization systems that are consistent, low-latency, highly available, and scalable. AuthZed also supported its approach with detailed performance methodology and published results. This combination of technical depth and measurable performance gave us confidence in AuthZed’s maturity as an authorization platform.”

“ReBAC was the most ideal solution that solves for many different scenarios, so it became a no-brainer choice as a starting point.”

“Initially, we tried to build our own authorization system. We quickly learned that building a permission engine is difficult, time-consuming, and resource-intensive. It requires deep subject-matter expertise across identity, access control, data modeling, and the different permission models used by each application. Even after supporting permissions for two applications, it became clear that continuing to build and maintain the system ourselves would be difficult to scale. We needed to have a more sophisticated platform to ingest more applications.”

“Especially the SRE work [that product teams] have to do—it’s usually pretty large during the launch phase. But with [AuthZed Dedicated], it’s almost all gone.”

“We’re ingesting billions of documents from our customers, and every single document needs its own very fine-grained permission. The volume of data we are materializing is very, very high.”

“Our product needs to replicate authorization from any possible third parties we want to connect to. Some are fairly complicated, like Google Drive. Others are simpler. But we need something flexible enough to expand to more third-party connections without re-architecting.”

“We decided to buy instead of build early on. This is an authorization system with established patterns. We didn’t want to reinvent the wheel when we could move fast with a proven solution.”

“The angle is that in cloud, the user feels like a single user. We want to make it transparent — you have a user, and a user is for everything.”

“We use identity providers for the authentication part. After that, we want an agnostic system that can understand our needs.”

“Our main use case is the lifecycle of the resource. Can I create a resource? Can I use the resource? Can I delete the resource? Can I see the resource? We use SpiceDB to control the access to that specific lifecycle.”

“We could prototype our whole system very quickly on the Playground. That was very useful.”

“There wasn’t much debate on whether or not to use AuthZed, to be honest.”