Skip to content

Commit 2f56d0c

Browse files
committed
rewrite intro to materialize
1 parent faff727 commit 2f56d0c

File tree

1 file changed

+24
-27
lines changed

1 file changed

+24
-27
lines changed

pages/authzed/concepts/authzed-materialize.mdx

+24-27
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,41 @@
11
import { Callout } from 'nextra/components'
22

3-
# AuthZed Materialize (Early Access)
4-
5-
AuthZed Materialize works with AuthZed Dedicated and is inspired by the Leopard index component described in the [Zanzibar paper](https://zanzibar.tech/2IoYDUFMAE:0:T).
6-
Much like the concept of a materialized view in relational databases, AuthZed Materialize supports SpiceDB permissions systems by precomputing permissions defined in your schema.
7-
8-
By creating a materialized view of your permissions in a relational database, you can efficiently sort, search, and filter massive lists of authorized objects while leveraging the authorization computation capabilities of SpiceDB.
3+
# AuthZed Materialize
94

105
<Callout type="info">
116
AuthZed Materialize is available to users of AuthZed [Dedicated] as part of an early access program.
127
Don't hesitate to get in touch with your AuthZed account team if you would like to participate.
138
</Callout>
149

15-
[Dedicated]: ../guides/picking-a-product#dedicated
16-
17-
## What Is AuthZed Materialize?
18-
19-
Materialize streams computed permission updates to a client.
20-
Updates occur after a relationship is written that affects a subject's membership in a permission set or a set’s permission on a specific resource.
21-
The intent is for users to process these updates and store them to form a precomputed and denormalized view of SpiceDB permissions.
10+
AuthZed Materialize takes inspiration from the Leopard index component described in the [Zanzibar paper](https://zanzibar.tech/2IoYDUFMAE:0:T).
11+
Much like the concept of a materialized view in relational databases, AuthZed Materialize is a service that you configure with a list of permissions that you want it to precompute, and it will calculate how those permissions change after relationships
12+
are written (specifically, when those relationships affect a subject's membership in a permission set or a set’s permission on a specific resource), or when a new schema is written.
13+
These precomputed permissions can then be used either to provide faster checks and lookups through Accelerated Queries, or streamed to your own application database to do operations like searching, sorting, and filtering much more efficiently.
2214

23-
## When To Use AuthZed Materialize?
15+
In summary, AuthZed Materialize allows you to:
2416

25-
If you need to provide a filtered and/or sorted list of more than several thousand authorized objects or if you need an authorization-aware search index, you probably need Materialize.
17+
- Speed up `CheckPermission` and `CheckBulkPermissions`.
18+
- Speed up `LookupResources` and `LookupSubjects`, especially when there is a large number of resources.
19+
- Build authorization-aware UIs, e.g. by providing a filtered and/or sorted list of more than several thousand authorized objects.
20+
- Perform ACL filtering in other secondary indexes, like a search index (e.g. ElasticSearch).
2621

27-
The primary use case for Materialize is to denormalize computed permissions into systems that excel at data retrieval operations like searching, sorting, and filtering.
28-
29-
There are some authorized object listing scenarios where [LookupResources] or [LookupSubjects], without Materialize, can return a response without a large computational cost.
30-
Those scenarios include:
31-
32-
1. Paginating through a list of authorized objects without sorting or filtering ([LookupResources] supports cursor-based pagination, but the list of objects is returned in a non-deterministic order)
33-
2. Listing a small set (in the realm of thousands) of ordered or filtered objects.
22+
[Dedicated]: ../guides/picking-a-product#dedicated
3423

35-
If you do make a [LookupResources] or [LookupSubjects] request with a significant computational cost, you can expect the request to be slow and to use a large number of system resources, leading to slower response times for other queries.
24+
## Limitations
3625

37-
## Current Limitations
26+
- Your schema can contain any of the following, but they cannot be on the path of your configured Materialize permissions or it will throw an error:
27+
- [Caveats]
28+
- [Wildcard] subject types
29+
- [.all intersections]
3830

39-
- [Caveats](https://authzed.com/docs/spicedb/concepts/caveats) are not supported on the path of permissions computed by Materialize
40-
- [Wildcard](https://authzed.com/docs/spicedb/concepts/schema\#wildcards) subject types are not supported on the path of permissions computed by Materialize
31+
- [Expiring relationships] aren't supported.
32+
- Materialize takes time to compute the denormalized relationship updates, so if you are streaming the changes to your database, your application must be able to tolerate some lag.
4133

42-
You can still use both Caveats and Wildcards, so long they are not part of the path to the permissions you've asked Materialize to query.
34+
[Caveats]: https://authzed.com/docs/spicedb/concepts/caveats
35+
[Wildcard]: https://authzed.com/docs/spicedb/concepts/schema\#wildcards
36+
[.all intersections]: https://authzed.com/docs/spicedb/concepts/schema\#all-intersection-arrow
37+
[expiring relationships]: https://authzed.com/docs/spicedb/concepts/expiring-relationships
38+
[Dedicated]: ../guides/picking-a-product#dedicated
4339

4440
## Client SDK
4541

@@ -411,6 +407,7 @@ When the origin SpiceDB instance introduces a schema change that invalidates all
411407
"change_at": {
412408
"token": "GiAKHjE3MTUzMzkzMTAzODQ2NDMxNzguMDAwMDAwMDAwMA=="
413409
}
410+
}
414411
}
415412
```
416413

0 commit comments

Comments
 (0)