Authorization at scale breaks long before logic becomes complex.
It breaks because the data model collapses:
roles, groups, permissions, inheritance, exceptions, conditions — they all stack.
Enma is a 12-part series where I rebuild authorization from scratch, step-by-step, ending with a production-ready Zanzibar-style engine.
This page is the master index for the full series.
✔️ Published Parts (12/12 Complete)
Why simple SQL permission tables collapse once you introduce teams, hierarchies, and conditional access.
2. Part 2 — Modeling Roles & Memberships (RBAC v1)
How roles actually work, and the hidden assumptions that cause them to fail as systems grow.
3. Part 3 — From Roles to Relationships (ReBAC v1)
How relationship tuples replace global roles and enable access flows like Google Docs.
Introduces boolean algebra for relationships (UNION, INTERSECTION, EXCLUSION).
4. Part 4 — Hierarchies & Inheritance (ReBAC v2)
Modeling "owner → editor → viewer", multi-level inheritance, and cross-object permission propagation.
Documents inherit viewers from parent folders.
5. Part 5 — Conditional Access (ABAC v1)
Making permissions depend on context: time, IP, device, deadlines, and runtime caveats.
Introduces tri-state logic (TRUE, FALSE, REQUIRES_CONTEXT).
6. Part 6 — Organization-Scoped Conditions
Wildcard subjects with scoped caveats: "Any user can view HR docs if department = HR."
Introduces namespaced parameters (principal.*, resource.*) for attribute matching.
7. Part 7 — Complex Boolean Logic (ABAC v2)
Multi-predicate conditions with Boolean algebra in caveats (AND/OR/NOT).
Introduces function calls (now(), contains(), startsWith()) for expressive policies.
📚 Part 7A — Boolean algebra + deterministic function calls inside caveats (ABAC v2) 🔗 https://submicro.beehiiv.com/p/post-7a-complex-boolean-logic-abac-v2
📚 Post 7B — Composite Caveats and Safety Measures (ABAC v2) 🔗 https://submicro.beehiiv.com/p/post-7b-composite-caveats-and-safety-measures
8. Part 8 — Schema-Level Safety Nets
Enforcing required caveats and subject constraints at the schema level.
Ensures all tuples obey mandatory business rules (e.g., "all users must have business_hours caveat").
9. Part 9 — Determinism and Tie-Breaks
Ensuring same inputs always produce same outputs across all evaluators.
Canonical signatures, ordering rules, and tri-state algebra for production safety.
10. Part 10 — Unknowns, Duplicates, and Fail-Safe Defaults
Handling schema changes, duplicate grants, and DoS protection with evaluation budgets.
Unknown caveats → FALSE, cycles → FALSE, budget exceeded → FALSE.
📚 Post 10A — Fail-Safe Defaults: Unknown Caveats and Duplicates
📚 Post 10A — Fail-Safe Defaults: Unknown Caveats and Duplicates
🔗 https://submicro.beehiiv.com/p/post-10b-budget-limits-and-dos-protection
11. Part 11 — Consistency and Revisions
📚 Post 11A - Revision-Based Snapshots
🔗 https://submicro.beehiiv.com/p/post-11a-revision-based-snapshots
📚 Post 11B — Production Deployment: Revisions at Scale
12. Part 12 — Final Model and Invariants
Complete specification of Enma Core Semantics with all invariants (INV-1 → INV-16).
Defines minimal interface surface for production-ready, verifiable implementations.
📬 Subscribe
Get notified when new parts are published:
🔗 Subscribe to SubMicro
🏗️ What You'll Build
By the end of this series, you'll understand:
✅ Why traditional authorization models break at scale
✅ How Google Zanzibar works (relationship-based access control)
✅ How to model roles, hierarchies, and conditional access
✅ How to build a production-ready authorization engine
✅ How to ensure determinism, consistency, and safety
Let's build it together.
📊 Series Structure
Phase | Posts | Theme | Difficulty |
|---|---|---|---|
Phase I — Groundwork | 1–2 | Simple tuples and roles | 🟢 |
Phase II — Graph Logic | 3–4 | Relationships and hierarchy | 🟡 |
Phase III — Attributes & Conditions | 5–7 | Context-aware caveats | 🟡🔴 |
Phase IV — Determinism & Safety | 8–10 | Constraints, ordering, protection | 🔴 |
Phase V — Consistency & Finalization | 11–12 | Revisions and invariants | 🔴 |
🎯 Who This Is For
Backend engineers building authorization systems
Engineering managers evaluating authorization solutions
Staff/Principal engineers designing distributed systems
Startup CTOs choosing between build vs. buy
Anyone curious about how Google Zanzibar works
Google Zanzibar Paper: Zanzibar: Google's Consistent, Global Authorization System
Auth0 FGA: Open-source Zanzibar implementation
SpiceDB: Production-ready authorization system
Ory Keto: Cloud-native permission system
Start with Part 1 → Why Traditional Authorization Breaks at Scale
