1 of 62

@Permissioned Spaces

Expressive Authorization at the PDS

@verdverm.com | @blebbit.app

2 of 62

About me & blebbit

@verdverm.com

@Dr Worm (Tony)

PhD CS / ML

DevOps / DevEx

I ♥️ CUE (cuelang.org)

@blebbit.app

Communities Platform

Discord, Discourse, Reddit,� FB Groups, GitHub, …

�github.com/blebbit

3 of 62

What are we talking about today?

Permissioned “spaces” in the PDS

Zanzibar and SpiceDB for ReBAC (relation based)

Capability Based tokens for delegation

Prototypes with ATProtocol

4 of 62

What are we NOT talking about today?

X E2EE encrypted data / messaging (~possible)

X Private Accounts (~possible)

X Keys and distribution (out of scope)

� Develop in parallel and become options for the people

5 of 62

Where do we start from?

Use Case and UX/DX

@bnewbold’s comment in #3363 - Private Data in the Repo?

Zanzibar & SpiceDB for ReBAC

Build, experiment, and talk in parallel together

6 of 62

Use-cases - (basically all existing apps)

Goal to craft a permissions fabric for all* apps?

Google & Apple accounts
Communities and private groups
App content / preferences / secrets
E2EE record content and blobs
PDS operators (admin ui)... ozone & labelers too?!
API keys, service accounts, app integrations
Business internal or SaaS operations

7 of 62

People want privacy online

The People are asking #ATProtoDev for solutions

Private accounts and group membership
Paid or restricted content
Small groups to big communities
Public vs private by default

The people also want public spaces with permissions!

8 of 62

Prototypes & Experiments

Spaces, Groups, Roles, Relations, Content

Limit to the @atproto/… packages

Credible Exitible Philosophy (CEP)

Backwards Compatible with repos and network

Foundation for @blebbit.app … really any app

SpiceDB … thinking about it like an SQL database

Apps outsource IAM, PDS handles Dual Write / New Enemy

9 of 62

Dual Write Problem (transactions)

Want transaction semantics

Write to 2+ databases

FUBAR failures

Hard Problem!

Authzed - The Dual Write Problem (blog)

Authzed - Solving the Dual Write Problem (video)

10 of 62

New Enemy Problem (consistency)

Alice has a group
Alice removes Darth
Alice adds a document

can Darth see new content for a moment?� when is the permission system consistent?

Zookie, an opaque consistency token

11 of 62

Zanzibar / SpiceDB

Relation Based Access Control (ReBAC)

SpiceDB is the open source Zanzibar
Scales both up and down, great SLAs
Developer friendly schema and operations
S-tier tooling, documentation, and learning materials
Supports all manner of setups
Credible Exit Philosophy (bulk, filtered export)
Firehose for auditing access and changes
Aligns well with AT-URI and PDS hosting
Avoid implementing permission query engine

12 of 62

Capability Based Tokens / Authorization

I’m new to this, grain of salt*

JWT stores a precomputed authorization
Caching, optimization layer, specific use cases
Enables delegation (App -> PDS -> PDS/Service)
Great for scaling the permissioned network
Requires a permission system

13 of 62

Relation to OAuth in @ATProtocol

OAuth Scopes Permissions and Relations

Permission Sets Roles

App <-> Account Account <-> Account

(App <-- PDS --> PDS )

15 of 62

@spaces? (╯°□°）╯︵ ɐʇɐp

Google Workspace | GCloud IAM like
Spaces, Groups, Roles, Relations, Content
Partition the permission space by DID
Every account has a /root space
Spaces and records nest, spaces contain everything
New com.atproto.space lexicons
A few tables in per-repo sqlite db, no MST

16 of 62

at://…?

AT-URI needs to grow…

at://<did>/<nsid>/<rkey> ... ?

17 of 62

at://verdverm.com…?space=my-space

AT-URI needs to grow… this is backwards compatible

at://<did>/<nsid>/<rkey> ? space = <skey> & ...

Unlocking query parameters is an interesting idea

19 of 62

@spaces?

/root

20 of 62

@spaces?

/root

owner

21 of 62

@spaces?

/root

/bsky

owner

@spaces?

admin

/root

parent

/team

/bsky

owner

@spaces?

admin

/root

parent

/team

/bsky

owner

read

/friends

31 of 62

@spaces?

admin

/root

parent

/team

/bsky

owner

read

post

/friends

32 of 62

@spaces? (╯°□°）╯︵ ɐʇɐp

admin

/root

parent

/team

/bsky

owner

read

post

/friends

33 of 62

@spaces? (╯°□°）╯︵ pɐǝɹ

admin

/root

parent

/team

/bsky

owner

post

/friends

34 of 62

@spaces? (╯°□°）╯︵ sddɐ

admin

/root

parent

/team

/bsky

owner

/friends

@prototype!

48 of 62

@blebbit / atproto

Fork of bluesky-social / atproto with patches

SpiceDB running next to the PDS

Schema, lexicon, and implementation, everything is wired up

Tooling for user-story experiments

PDS container image and pnpm overrides for clients

R&D instance & test network (permissioned relays experiments?!)

49 of 62