Zanzibar: Google's Consistent, Global Authorization System
USENIX Annual Technical Conference, 2019 · paper · Computer science
Presents Zanzibar, Google's global system for storing and evaluating access control lists across services like Drive and YouTube. It reports scaling to trillions of lists and millions of requests per second, with under 10 ms 95th-percentile latency and over 99.999% availability.
Checked: PDF from usenix.org, fetched 4 Oct 2026. Page numbers are those of that PDF.
0 findings
None that passed a second check.
10 minor (typos and the like; most checked by the judge only)
Reference or label §4.5 Freshness bullet: the sentences on tuning snapshot-timestamp granularity ('coarse timestamp quanta') end with 'See §3.2.1.', but timestamp quantization is described in §3.2.5.
- p. 12 §4.5, 'Freshness requirements' bullet
frequency of database reads. See §3.2.1.
- p. 9 §3.2.5 Handling Hot Spots
This timestamp quantiza-
- p. 9 §3.2.5 Handling Hot Spots
We choose evaluation timestamps rounded up to a coarse granu-larity
- p. 12 Section 4.5, Freshness bullet
thus greatly reducing the frequency of database reads. See §3.2.1.
Judge's note: §3.2.1 (pp7-8) covers only the default-staleness mechanism. Rounding timestamps to one or ten seconds is in §3.2.5 (p9), and §2.2 (text line 324) itself cites §3.2.5 for quantization. The first half of the bullet does match §3.2.1, so the pointer is incomplete rather than wrong.
Second check: another model agreed
Report a problem with this finding
Wording §4.2: 'the more frequently used Safe versions of Check, Read, and Expand are significantly faster than the less frequently used Recent versions'. In Table 2 the 50%ile is 3.0 ms for Safe Check against 2.86 ms for Recent Check, and 2.18 vs 2.21 ms for Read.
- p. 11 §4.2 Latency, last paragraph
Read, and Expand are significantly faster than the less fre-
- p. 11 Table 2, Check rows, 50%ile column
2.86 (0.087)
- p. 11 §4.2, paragraph on Table 2
the more frequently used Safe versions of Check, Read, and Expand are significantly faster than the less fre-quently used Recent versions
Only the authors can say what is right here.
Judge's note: Checked Table 2 on p11. At the 95th and 99th percentiles Safe is much faster (Check 9.46 vs 60.0 ms; Read 3.71 vs 40.1 ms; Expand 8.84 vs 45.6 ms). At the median, Safe Check is slower than Recent Check and Read is essentially the same. The unqualified claim describes tail latency, and the text should say so.
Second check: another model agreed
Report a problem with this finding
Wording §5: 'Lamport clocks [22] provide partially ordered vector timestamps'. Ref [22] is Lamport 1978, 'Time, clocks, and the ordering of events'.
- p. 13 §5 Related Work, Lamport paragraph
Lamport clocks [22] provide partially ordered vector timestamps
- p. 13 Related Work
provide partially ordered vector
Only the authors can say what is right here.
Judge's note: Rests on outside knowledge: Lamport's 1978 logical clocks are scalar, and vector timestamps come from later work (Fidge/Mattern). The page image and reference [22] read as the finding quotes. The authors should confirm the intended description.
Second check: another model agreed
Report a problem with this finding
Wording §5: 'POSIX ACLs [4] add an arbitrary list of users and groups, each with up to 32 permissions bits', but [4] is 'DCE 1.1: Authentication and Security Services'.
- p. 13 §5 Related Work
POSIX ACLs [4] add an arbitrary list of users and groups, each with up to 32 permissions bits.
- p. 14 Reference [4]
DCE 1.1: Authentication and Security Services.
Only the authors can say what is right here.
Judge's note: Rests on outside knowledge: the 32-bit permission sets are a feature of DCE ACLs (which extend draft POSIX ACLs), whereas draft POSIX 1003.1e ACLs use read/write/execute bits. The page shows the label 'POSIX ACLs' with the citation to the DCE 1.1 spec. Only the authors can say whether the label or the reference is intended.
Second check: another model agreed
Report a problem with this finding
Typo §3.2.4: 'allows reachability to be efficently evaluated by Leopard' should read 'efficiently'.
- p. 8 §3.2.4, reachability paragraph
allows reachability to be efficently evaluated by
- p. 8 3.2.4 Leopard, reachability paragraph
reachability to be efficently evaluated by
Judge's note: The misspelling is visible in the page 8 image.
Second check: none (judge only)
Report a problem with this finding
Typo §3.2.4: 'The Leopard servers continously watch for new shards' should read 'continuously'.
- p. 9 §3.2.4, offline index builder paragraph
The Leopard servers continously watch for
Judge's note: The misspelling is visible in the page 9 image.
Second check: none (judge only)
Report a problem with this finding
Typo §3.2.6: 'it limits the number of oustanding RPCs per client' should read 'outstanding'.
- p. 10 §3.2.6 Performance Isolation
its the number of oustanding RPCs per client.
- p. 10 3.2.6 Performance Isolation
it lim-its the number of oustanding RPCs per client
Judge's note: The misspelling is visible in the page 10 image. The previous sentence spells 'outstanding' correctly.
Second check: none (judge only)
Report a problem with this finding
Typo §4.1: 'can be served within the region most of time' should read 'most of the time'.
- p. 11 §4.1 Requests (continued)
served within the region most of time
Judge's note: The missing article is visible in the page 11 image.
Second check: none (judge only)
Report a problem with this finding
Typo §4.5 Hot-spot mitigation bullet: 'the need to optimize specific uses cases' should read 'use cases'.
- p. 12 §4.5, 'Hot-spot mitigation' bullet
uses cases. For example, we added cache prefetching
Judge's note: The error is visible in the page 12 image.
Second check: none (judge only)
Report a problem with this finding
Typo Ref [17]: 'Role-based access control. In In 15th NIST-NCSC National Computer Security Conference' has a duplicated 'In'.
- p. 15 Reference [17]
control. In In 15th NIST-NCSC National Computer Se-
- p. 15 Reference [17]
In In 15th NIST-NCSC National Computer Se-curity Conference
Judge's note: Both 'In's are printed in the page 15 image, the second in italics as part of the venue name.
Second check: none (judge only)