How should teams size an authorization system when relationship graphs grow from millions to 100 billion entries?

Why This Matters for Security Teams

When relationship graphs expand from millions to 100 billion entries, authorization stops being a simple policy lookup problem and becomes a data systems problem. The common failure is sizing for average request latency while ignoring graph shape, cache locality, and write amplification from relationship churn. That underestimates the cost of traversals, hot partitions, and consistency checks that appear only at scale. Current guidance suggests teams should treat authorization throughput as part of the application’s critical path, not as a background dependency. NHI Mgmt Group notes that 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, which is one reason graph-backed authorization has become operationally central rather than optional, as discussed in the Ultimate Guide to NHIs. For teams that also need baseline control expectations, NIST SP 800-53 Rev 5 Security and Privacy Controls remains useful for mapping authorization decisions to access control and monitoring requirements. In practice, many teams discover graph bottlenecks only after production data and real tenancy patterns have already exposed them.

How It Works in Practice

Sizing starts by separating the costs of

CheckPermission

and

WriteRelationship

. A permission check may be fast on paper, but the real cost depends on how many edges must be traversed, whether the graph is shallow or deeply nested, and whether the cache can satisfy repeated lookups for the same subject-object patterns. Writes are different: relationship updates can invalidate caches, trigger index maintenance, and create consistency work that scales with graph density rather than raw request count.

Teams should load test against representative graph shapes, not synthetic averages. That means testing wide fan out, long inheritance chains, multi-tenant isolation boundaries, and bursts of relationship churn. It also means measuring the system at the actual dataset sizes expected in production, because a million-entry graph and a 100 billion-entry graph behave like different products.

• Profile the 95th and 99th percentile for permission checks, not just mean latency.
• Separate read-heavy and write-heavy workloads so cache effects do not hide write-path cost.
• Test cold cache, warm cache, and cache churn scenarios.
• Measure partition skew and traversal depth as first-class capacity variables.
• Set SLOs for both authorization reads and relationship writes before rollout.

The practical question is not whether the engine can answer one query quickly, but whether it can sustain that speed under realistic tenancy, edge growth, and change rates. For teams building around NHI-heavy environments, the relationship graph is often the control plane for service accounts, API keys, and workload access, not just a storage layer. The Ultimate Guide to NHIs is useful background for understanding why that identity sprawl creates more edges, more churn, and more pressure on authorization infrastructure. These controls tend to break down when relationship updates spike across many tenants at once because cache invalidation and index maintenance become the dominant cost.

Common Variations and Edge Cases

Tighter authorization design often increases operational overhead, requiring organisations to balance stronger correctness against lower latency and simpler operations. One common edge case is a graph that is small in total size but highly skewed, where a few subjects or resources become hot and drive disproportionate load. Another is a hybrid model where most access checks are simple, but a minority require deep traversal across delegated or inherited relationships. Best practice is evolving here, and there is no universal standard for how much of that complexity should be pushed into precomputation versus runtime evaluation.

Teams should also watch for consistency tradeoffs. Stronger consistency can make writes more expensive, while eventual consistency can create short-lived authorization drift that is unacceptable for high-risk access paths. Multi-region deployments add another layer, because replication lag can change the effective size and freshness of the graph seen by each request path. In those environments, capacity planning should include failure-mode testing, not just steady-state throughput.

When the relationship graph is used for both human and non-human identities, the growth curve can accelerate faster than expected because machine identities generate more frequent entitlement changes than human users. That is where pre-sizing by historical averages fails. Teams need to model not just current graph size, but how fast the graph grows, how often it mutates, and which paths must remain available under pressure.

Related resources from NHI Mgmt Group

• How should security teams keep identity tokens from becoming a second authorization system?
• How should security teams compare DAST tools that overlap on authorization testing but differ in discovery depth?
• How should security teams implement authorization for RAG-based AI agents that query sensitive business data?
• What do teams get wrong about using session tokens for backend authorization checks?