System Design

Access Control

Design the access control system for a document sharing product like Google Drive.

Functional requirements

• Owners share a document or folder with a user or a group at a role (viewer, commenter, editor, owner) and can revoke that share at any time.
• Documents inherit permissions from their folder chain, and a document or folder can be moved to another folder, changing what it inherits.
• Groups contain users and other groups (e.g., eng-all contains eng-backend, which contains a user), and a membership change affects access everywhere the group is used.
• Any product service can ask 'can user X perform action Y on document Z' through a check API that is called on every document read, edit, and listing.
• A user can list every document they have access to, and an owner can see everyone who has access to a document and through which path (direct, group, or folder).

Non-functional requirements

• Check is the critical path of every product request: p99 under 10ms and p50 under 2ms at the service boundary, at 2M checks per second.
• Revokes must never be served stale: once a revoke or a group removal is acknowledged, no later check anywhere may return allow for that user (the 'new enemy' problem); a new grant may take up to 10 seconds to become visible.
• Availability for checks: the check API survives the loss of any zone; degraded modes fail closed (deny), never open.
• Every grant, revoke, move, and membership change is durable and auditable once acknowledged; a lost permission write is a security incident.
• Isolation: a check for one organization can never be influenced by another organization's data, and the permission store holds identifiers only, never document content.

Scaling & constraints

• 1B users, 10B documents, and ~50B stored permission relations (about 5 per document counting folder and group edges) at ~100 bytes each (~5 TB).
• 2M checks per second at peak and ~500,000/sec on average; writes (grants, revokes, moves, membership changes) are ~10,000/sec.
• Read:write ratio is roughly 200:1 (checks vs. permission changes).
• Group nesting goes up to 10 levels deep; the largest groups (e.g., all-hands) have 200,000 members and are attached to ~1M documents.
• Folder depth goes up to 20 levels; a single folder move can change the effective permissions of up to 5M descendant documents.
• Traffic is skewed: 1% of documents receive 50% of checks, and one hot document during an incident can be checked 50,000 times per second.

Out of scope

• Authentication, sessions, and identity providers.
• Document content storage, editing, and file synchronization.
• The sharing UI and public link sharing with anyone who has the link.
• Organization-wide admin policies such as DLP and external sharing restrictions.