Hacker News Reader

Zanzibar: Google’s Consistent, Global Authorization System

https://research.google/pubs/zanzibar-googles-consistent-glo...

Thanks, this looks interesting.

Wouldn't a geo-replicated single-primary DB suffice? Reads would have low-latency, and only writes would pay for the latency to reach the primary far away.

Amazon has open sourced their policy engine https://github.com/cedar-policy/cedar

Cedar is not the policy engine used by AWS IAM. Other AWS services do use it, though: https://www.cedarpolicy.com/en/integrations