The Southern Capital’s archive stood in the north of the city: a seven-storey stone tower, with a sea wind that ran all night through the bronze bells under the eaves.

Inside were the city’s land deeds, marriage contracts, boat indentures, wills. An ordinary person entered the tower once in a lifetime and spent a day there.

The keeper was surnamed Shen. People called him Shen of the Seven Storeys.

He kept one rule, and every lord mayor for six generations had cursed it: the tower holds no roster.

No page anywhere said who might enter which room. No master register. No admission book sorted by family name. No list that could be taken out and burned.

On her first day the new clerk, A-Tang, asked: when a visitor comes, how do I know whether to let him in?

Shen said: you go and ask.

—

Ask whom?

Ask the people who remember only one thing each.

Every guild hall, boat society, workshop and ancestral shrine in the south of the city kept one thin book. The book recorded relations between two things, one line at a time, and never a second layer.

— This boat indenture is read by the boat society.

— A-Tang entered the boat society last autumn.

— The boat society answers to the Canal Office.

— The Canal Office answers to the archive in the north.

One line joined two places. The boat society had no need to know who stood above the Canal Office, nor who A-Tang’s master was. It acknowledged only the two names on that one line, the pair it had seen with its own eyes.

So when A-Tang had to answer whether this fisherman might see his grandfather’s boat indenture, she could not look it up. She had to walk.

First stop, the boat society. Who may read this indenture? — Members of the society, and men of the Canal Office.

Second stop. Is this fisherman a member? — He is. One line: entered in autumn.

Done. Two stops. The door opens.

The first thing Shen gave her was not a key. It was a bamboo staff with seven notches cut into it.

Seven stops at most. At the eighth, the answer is always no.

The second thing was a rule: on one errand, never enter the same door twice. With enough people the books double back on themselves — a man of the first society belongs to the second, and the second’s book names the first. Walk long enough and you circle until dark.

The first page of each book also said which strokes this office was permitted to use:

• Any one will do.
• All must hold.
• All but him.

The first two may be carried down the chain. The third may not. “All but him” is allowed only on the office’s own first page; it may never be carried into the next book. Shen set that rule not out of fussiness: a subtraction buried deep in a chain is a subtraction whose size you cannot compute.

West of the tower stood a small room, and in it an old woman with several hundred fan-shaped bamboo tablets spread before her.

She had walked the walking in advance. One tablet to a society, and on each tablet the names of everyone beneath that society. A-Tang had only to push the door open and the tablet was already in her hand, its corner marked with the notch of the water clock.

If the notch A-Tang required was newer than the one on the tablet, the old woman took the tablet back and said two words: go walk.

—

That autumn something happened.

At noon, the smiths’ guild struck out a line. A man was expelled from his master’s house and vanished from the book.

But at eleven that morning A-Tang had answered a question about him. The answer carried a seal, and the seal hung on the door of the sealed vault.

All day he came and went through that door and nobody stopped him. By evening three scrolls of weapon drawings were gone.

The old keeper threw the seal down on the desk. He did not accuse A-Tang of lying.

He said: you did not lie. You answered a question that had already changed.

—

An answer is not the truth of this moment. An answer is the truth of the moment at which you read the books.

So the tower changed its rule: every answer must carry the notch of the water clock. The notch is not the hour. It is which moment the books were in when I read them.

A small line was later cut into the door of the sealed vault:

This door accepts no notch earlier than its own last change.

Revocation thus became very cheap: strike out one line. At the instant of the striking, every answer older than it is void at once — no paper to chase down, no man who once stamped a seal to go and find.

The gate clerks at each city gate kept a small stack of copied tablets between them, answering only the three or five questions asked most often. The copies carried notches too. When the notch moved, the tower sent men round to replace them, gate by gate. That was the only thing the tower had to do every single day.

That winter the fisherman entered the tower. He had no letter of introduction, and A-Tang did not know him.

She had simply walked the two stops.

By now you have probably recognized it: this is Zanzibar-style relationship-based authorization — ReBAC.

What it is

Zanzibar is the global authorization system Google published in 2019, serving Drive, Docs, Calendar and YouTube from one permission decision service. Its central choice: store facts, never conclusions.

The facts are relation tuples, shaped like document:annual-report#viewer@user:A-Tang, or document:annual-report#viewer@group:boat-society#member. Three parts: object#relation@subject. The important part is the last one — the subject may be a person, or a relation on another object. That is the door recursion walks through: a book may point at a book.

A check for document:annual-report#viewer@user:A-Tang becomes an evaluation tree: hit a tuple and return, meet a userset and expand, keep going. Authorization is therefore not a lookup but a bounded-depth graph walk. A role is not something granted; it is a path in that graph.

Userset rewrites combine paths: union (any one will do), intersection (all must hold), exclusion (all but him). Zanzibar restricts where exclusion may nest, precisely so the cost of that walk can be bounded.

Zookies are the notch of the water clock: every decision returns an opaque version stamp, and a client presenting it is promised an answer no older than that. They exist for the new enemy problem — whether a man just stripped of a permission can keep walking in on a cached answer from five minutes ago. Any cached authorization conclusion becomes a lie the instant the underlying relation changes; a version stamp makes staleness detectable instead of something you guess with a TTL.

Leopard is the old woman: a materialized index that pre-computes portions of the walk, answering hits directly and falling back to the graph on misses, with a freshness check attached. The index makes you fast and it makes you old; an index too old for the request must admit it and walk.

Why it matters

• It is sparse. The permission matrix is all subjects × all objects and is almost entirely empty. Tuples draw only the edges that exist: a million users times ten million documents does not fit anywhere, but the real edges number in the tens of millions. Storing edges instead of cells is the first stone this design stands on.
• Revocation is a line, not a broadcast. An ACL revokes by editing dozens of lists. Here you delete one tuple and every downstream decision dies at once — because no conclusion was ever stored, only facts.
• Composition costs nothing at write time. Ten thousand people joining a group is one tuple; if that group has a parent, no one has to touch ten thousand documents. Fan-out happens at read, not at write.
• It replaces RBAC’s role explosion. Describing “who may see which document” with roles makes the role count grow with objects times relations until nobody can administer it. ReBAC has no role table, only paths — paths are computed, not configured.
• Bounded depth is what puts it on the hot path. Every decision stands in front of a request, so the walk must stay shallow: depth limits, cycle refusal, restricted exclusion nesting, a p99 target in single-digit milliseconds. Zanzibar’s capacity limit is not database capacity; it is traversal budget.
• Cache correctness becomes provable. A version stamp turns “how stale is this answer” into a comparable quantity, so caching stops being a gamble and becomes conditional reuse. This is the least glamorous and most expensive part of the whole system.
• Consistency is a snapshot, not a line. A decision reads one consistent snapshot and does not insist on matching the newest write. The price is carrying “which moment I read” explicitly; the reward is answering in parallel from dozens of replicas worldwide.
• It became the industry’s floor. SpiceDB, OpenFGA, Auth0 FGA and Permify all implement this model, and most SaaS permission questions outside Kubernetes reduce to one question: do you need a relationship graph?

Metaphor mapping

• No roster in the tower; only one line of direct relation kept at each office → tuple storage; the “who can access what” conclusion is never materialized
• One line joins two places and never a second layer → tuples hold direct edges only; transitive relations are computed by traversal
• “This boat indenture is read by the boat society” → document:indenture#viewer@group:boat-society#member, the subject is a userset
• “A-Tang entered the boat society last autumn” → group:boat-society#member@user:A-Tang
• A book may point at another book → a tuple’s subject recursively names another object’s relation; the walk unfolds from there
• A-Tang cannot look it up, she must walk → a check is a graph traversal query, not an index match
• The staff with seven notches → maximum traversal depth; anything deeper is denied
• No door twice on one errand → cycle detection during traversal; the relation graph contains cycles
• Any one will do / all must hold / all but him → union / intersection / exclusion userset rewrites
• “All but him” may sit only on the office’s own first page → exclusion is restricted in where it nests, to keep evaluation bounded
• Shen’s rule is not fussiness; a deep subtraction has no computable size → nested exclusion makes evaluation cost uncontrollable
• The old woman walks the walking in advance; one tablet names everyone beneath a society → materialized index (Leopard), which skips graph traversal on a hit
• The tablet is in A-Tang’s hand before she asks → the index turns common checks into a point lookup
• The tablet’s corner carries a water-clock notch → index entries carry a freshness stamp
• A newer notch than the tablet’s means “go walk” → index lags the version the request requires, so fall back to the graph
• At noon the smiths’ guild strikes out a line → revocation is one tuple delete; write cost is constant
• The seal stamped at eleven keeps admitting the man all day → a cached authorization answer becomes false on revocation
• “You did not lie. You answered a question that had already changed.” → the new enemy problem: the decision logic was right, the answer was stale
• Every answer must carry the water-clock notch → zookie: decisions return an opaque version stamp
• “This door accepts no notch earlier than its own last change” → the write side demands a minimum freshness; stale answers are refused, not silently accepted
• Older answers void at the instant of striking, with no paper to chase → version-range invalidation; no need to hunt down and delete each cached answer
• Gate clerks keep a small stack of copied tablets → read-only serving replicas and local caches absorbing most checks
• When the notch moves, men are sent to replace the copies gate by gate → replicas advance by version; invalidation is version-driven, not heartbeat-driven
• Replacing the copies is the only daily obligation the tower has → replica catch-up is this system’s main operational burden
• Two stops and the door opens; the fisherman had no letter of introduction → decisions rest on a path in the graph, not on pre-granted roles or tickets
• Answer before the gate clerk calls twice → authorization sits on the request path, so traversal budget is capacity budget
• The tower does not promise “newest”, only “no older than the notch you demanded” → snapshot-consistent reads rather than linearizability, buying cross-replica parallelism