How Google's Leopard Index makes Zanzibar auth checks two lookups at any nesting depth

arpit_bhayani · x · 2026-09-19

Google's Zanzibar authorization system powers access control across Drive and YouTube, and its Leopard Index is what keeps permission checks fast.

The model: users belong to groups, and groups can nest arbitrarily deep. Naive membership checks walk the chain hop by hop across machines on every access.
Leopard precomputes two tables: member→group (direct memberships) and group→group (a group mapped to every nested subgroup at any depth). Checking if Alice is in engg is just two lookups plus one set-intersection — constant cost regardless of depth.
The trade-off is on the write side: nesting a group updates many precomputed entries. Worth it because checks vastly outnumber membership changes — the classic read-vs-write trade.
Freshness comes from periodic full rebuilds combined with a stream of recent changes.

Takeaway: if a hot read path has a slow graph walk, precomputing answers may be worth considering.

More from Infra