Katkat
Back

Design authorization and audit logging systems

RobinhoodSoftware Engineer · Onsite
MediumSoftware EngineerOnsiteSystem Design

Last updated

This question tests your ability to design a scalable, low-latency authorization framework and a reliable, tamper-proof audit logging system for a financial platform.

Problem Statement

Design a distributed authorization service and an audit logging infrastructure for a high-frequency trading platform. The platform handles millions of transactions daily and requires fine-grained access control to sensitive user data, trading APIs, and administrative functions.

Requirements

Authorization:

  1. Support Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) to accommodate complex policy requirements (e.g., 'Traders can only access accounts in their assigned region during market hours').
  2. Minimize latency for authorization checks, as they occur on every API request.
  3. Ensure high availability; if the authorization service is down, critical trading actions must not be performed.

Audit Logging:

  1. Capture all access decisions (granted/denied) and sensitive mutations.
  2. Logs must be immutable and tamper-evident.
  3. The system should support near real-time auditing and historical analysis for compliance and security forensics.

Scale Assumptions

  • Peak traffic: 50,000 requests per second.
  • Audit log retention: 7 years for compliance.

Your Response Should Include

  • A high-level architecture diagram (described in text).
  • API design for the authorization check.
  • Strategies for caching policy decisions and handling cache invalidation when permissions change.
  • Data storage choices for audit logs to balance cost and query performance.

Hints

Hint 1

Consider decoupling the policy decision point (PDP) from the policy enforcement point (PEP) using a sidecar pattern to minimize latency.

Hint 2

Use a tiered storage approach for audit logs, such as moving historical logs to cold storage (e.g., S3 Glacier) while keeping recent logs in an indexed store like Elasticsearch.

Hint 3

To ensure immutability, consider using cryptographic hashing (e.g., Merkle trees) to chain log entries so that unauthorized deletions or modifications are detectable.

Follow-up questions

  • How would you handle global policy updates that need to take effect across the entire fleet in under 500 milliseconds?
  • If the authorization service latency spikes, how would you design a 'fail-safe' or 'fail-open' mechanism without compromising security?
  • How would you detect an anomaly where a user account is accessed from two geographically distant locations simultaneously?