Katkat
Back

Design an IAM system for services and users

CoupangSoftware Engineer · Onsite
MediumSoftware EngineerOnsiteSystem Design

Last updated

This question evaluates understanding of Identity and Access Management concepts including authentication and authorization flows, role- and policy-based permissions, temporary credential handling, multi-tenant access control, auditing, and scalability considerations.

System Design Prompt

Design an Identity and Access Management (IAM) system for an organization/platform.

The system must support:

  • Human users and service identities (workloads)
  • Authentication (who are you?) and authorization (what can you do?)
  • Managing permissions via roles/policies
  • Auditing and compliance reporting

Requirements

  • Multi-tenant support (multiple orgs/projects/accounts)
  • Fine-grained permissions (resource + action)
  • Temporary credentials for services (no long-lived secrets if possible)
  • API access control for internal microservices
  • Admin UI/CLI for managing users/roles/policies

Deliverables

  • Core data model (principals, resources, roles, policies)
  • AuthN/AuthZ flows and token format
  • Policy evaluation approach
  • Auditing, revocation, and key rotation
  • Key trade-offs and scaling considerations