Katkat
Back

Design an access control system (RBAC + resource-based)

AtlassianSoftware Engineer · Onsite
MediumSoftware EngineerOnsiteSystem Design

Last updated

This question evaluates a candidate's ability to design a scalable authorization system incorporating RBAC and resource-based ACLs, testing competencies in access-control models, data schema design, policy evaluation, API design, caching strategies, and audit logging.

Design an authorization system that supports both:

  • Role-Based Access Control (RBAC): users/groups have roles (e.g., Admin, Editor, Viewer) that grant permissions.
  • Resource-based permissions (ACLs): individual resources can grant permissions directly to users/groups (e.g., a specific page shared with a user).

Requirements:

  • Support common actions: read, write, delete, share, admin.
  • Must work across multiple resource types (spaces, pages, projects, issues).
  • Provide APIs to grant/revoke access and to check authorization.
  • Discuss policy evaluation, data model, caching, and audit logs.

Deliverables:

  • Core entities and schema.
  • Permission evaluation algorithm.
  • REST APIs.
  • Edge cases (deny overrides? inheritance? group membership changes?).