Sign in to track progress, unlock prep layers, and browse your pipeline.Sign in
Design an access control system (RBAC + resource-based)
Role-Based Access ControlAccess Control ListsGraph DatabasesCaching StrategiesDistributed System Consistency Models
Problem Statement
Design a robust authorization system capable of supporting both Role-Based Access Control (RBAC) and Resource-Based Permissions (ACLs).
Core Functionality
- Role-Based Access Control (RBAC): Users and groups are assigned roles (e.g., Admin, Editor, Viewer) which inherently grant a predefined set of permissions.
- Resource-Based Permissions (ACLs): Individual resources can have specific permissions granted directly to users or groups (e.g., a particular document shared with a specific user).
Requirements
- Actions: The system must support common actions such as
read,write,delete,share, andadmin. - Resource Types: It must be flexible enough to operate across various resource types, including but not limited to spaces, pages, projects, and issues.
- APIs: Provide a comprehensive set of APIs for granting access, revoking access, and performing authorization checks.
- Discussion Points: The design should explicitly address policy evaluation mechanisms, the underlying data model, caching strategies for performance, and the implementation of audit logs for traceability.
Deliverables
- Core Entities & Schema: Define the fundamental entities involved and their relationships, along with a proposed database schema.
- Permission Evaluation Algorithm: Detail the logic and steps involved in determining whether a user has permission for a given action on a specific resource.
- REST APIs: Outline the design for the necessary RESTful endpoints.
- Edge Cases: Address critical edge cases such as how deny overrides are handled, the mechanism for permission inheritance, and the impact of dynamic group membership changes.
AI interview prep
Core dilemma
Balancing the complexity and flexibility of a hybrid RBAC/ACL model with the performance and scalability requirements of real-time authorization checks at a large scale, while ensuring strong security and auditability.
Mid-level signals3
Senior signals3
Red flags3
3 tradeoffs and 3 stress tests locked
Interview prep
Unlock the interviewer X-Ray rubric, tradeoff matrix, stress tests, clarifying questions, and key concepts.
Design an access control system (RBAC + resource-based)
Role-Based Access ControlAccess Control ListsGraph DatabasesCaching StrategiesDistributed System Consistency Models
Problem Statement
Design a robust authorization system capable of supporting both Role-Based Access Control (RBAC) and Resource-Based Permissions (ACLs).
Core Functionality
- Role-Based Access Control (RBAC): Users and groups are assigned roles (e.g., Admin, Editor, Viewer) which inherently grant a predefined set of permissions.
- Resource-Based Permissions (ACLs): Individual resources can have specific permissions granted directly to users or groups (e.g., a particular document shared with a specific user).
Requirements
- Actions: The system must support common actions such as
read,write,delete,share, andadmin. - Resource Types: It must be flexible enough to operate across various resource types, including but not limited to spaces, pages, projects, and issues.
- APIs: Provide a comprehensive set of APIs for granting access, revoking access, and performing authorization checks.
- Discussion Points: The design should explicitly address policy evaluation mechanisms, the underlying data model, caching strategies for performance, and the implementation of audit logs for traceability.
Deliverables
- Core Entities & Schema: Define the fundamental entities involved and their relationships, along with a proposed database schema.
- Permission Evaluation Algorithm: Detail the logic and steps involved in determining whether a user has permission for a given action on a specific resource.
- REST APIs: Outline the design for the necessary RESTful endpoints.
- Edge Cases: Address critical edge cases such as how deny overrides are handled, the mechanism for permission inheritance, and the impact of dynamic group membership changes.