Zanzibar

What Zanzibar Is in Access Control

Zanzibar is a relationship-based authorization model built for large-scale permission checks across many services. Its core idea is to represent who can act on what as structured relationships, then evaluate those relationships consistently and quickly, which makes it well suited to fine-grained, distributed access decisions.

That matters because modern authorization is rarely just role lookup. Systems need to express nested group membership, resource hierarchies, delegated access and inherited permissions without forcing every application to rebuild the logic independently.

How Zanzibar Represents Permissions

Zanzibar models access as tuples or relationships between subjects and objects, rather than as a flat list of static grants. This lets an authorization service answer questions such as whether a user belongs to a group that has access to a folder, document or application feature, while still supporting complex inheritance and exclusion rules.

The practical value is flexibility. A single model can represent direct grants, indirect access through groups, ownership-like relationships and policy composition across products. That is why Zanzibar influenced later relationship-based access control designs and centralized authorization services such as Google Zanzibar, OpenFGA and SpiceDB.

Why Zanzibar Scales for Distributed Systems

Zanzibar is designed for very high request volumes and low latency, which is important when authorization becomes part of every API call or page action. Instead of each service calculating permissions on its own, a shared authorization layer can evaluate relationship graphs consistently and cache the results where appropriate.

This architecture helps reduce drift between services, but it also increases the importance of consistency, freshness and rollout discipline. In distributed authorization, the hard problem is not only answering quickly, but answering with the same policy view everywhere so users do not see contradictory access decisions.

Fine-Grained Authorisation Guide

Where Zanzibar Sits in the Authorization Landscape

Zanzibar is best understood as a relationship-based authorization pattern, not as a replacement for every other access model. RBAC still works well for coarse job-based permissions, ABAC remains useful for attribute-driven decisions, and policy-based access control can express broader decision logic. Zanzibar becomes most valuable when relationships are the dominant source of truth.

That distinction matters operationally. If an organisation tries to force every permission rule into one model, it usually ends up with brittle policy, hidden exceptions or duplicated logic. Zanzibar’s strength is that it provides a centralized, expressive way to model relationships while still supporting multiple access patterns around it.

Authorisation Models Guide

Related resources from NHI Mgmt Group

• How should teams implement time-bound access in a Zanzibar-style authorization system without creating clock-skew problems?
• Why does a Zanzibar-style authorization model help with complex access control at scale?
• How should teams design a Zanzibar-style authorization service for low-latency, highly available permission checks?
• What is the difference between dispatch and datastore access in a Zanzibar-style authorization architecture?