Avoid Broken ACLs in Control Planes With Declarative RBAC

The talk opens with a common problem in building secure platforms: authorization checks are often hand-written conditionals scattered across an API server, which become hard to test and reason about as policies grow. Broken access control sits near the top of the OWASP API risks, and organisations that run many services with incompatible permission models struggle to see who can reach what.

The speaker compares offline token-based checks with centralized lookups, weighing revocation, consistency, availability and caching. Policy engines such as OPA and Cedar suit payload-driven decisions but struggle with reverse queries about who can access a resource. Relationship-based access control is then presented as a graph where permissions are paths between user and resource nodes, defined by a small schema. Worked examples cover team membership, role inheritance across folders and documents, and attribute combinations such as region and environment, all expressed in one graph. Published SpiceDB load figures are used to argue the model scales to very large edge counts.

The closing section sketches a control plane request flow, with authentication, flow control, authorization against a relationship store, admission, and filtered list responses, plus a controller that imports existing permissions into the graph. The practical takeaways are to separate policy decisions from application code, to test policies for equality and regression before rollout, to avoid letting users grant access they do not hold, and to build on existing open-source engines such as SpiceDB or OpenFGA instead of writing a graph engine from scratch.