0

Your cart

TOTAL excl.
TOTAL incl.
Pay
Go back

From Friction to Platform: Redesigning a Permissions System at Scale

REXCommunication et CollaborationCulture et MéthodologieDevSecOpsSécurité : Données / Accès / EmailGovernanceOpen Source

2026-12-09 | 02:25 PM - 02:55 PM

Information

Case study: from a fragmented permissions system (7 types, 17 endpoints, 3-week delay) to a ReBAC platform with OpenFGA — a gradual overhaul, without a big bang, encompassing around thirty products and teams. When tech strategy serves a product vision and business objectives.

Permission systems often start as a technical detail… before becoming a platform issue.

For a long time, our permission management relied on a set of heterogeneous systems: 7 types of permissions, 17 endpoints, implicit rules, strong dependencies between teams and a time-to-market that could take up to 3 weeks for a simple change of right.

During this talk, I will share, as PM, how this friction was transformed into a real product platform, with a pragmatic intermediate step around a single "has-access" endpoint — already adopted on a large scale (more than 1 million requests per week absorbed, 15ms average latency, 11 endpoints removed, integration time reduced from 7 to 3 days) — then a ReBAC target based on explicit and auditable business relationships thanks to OpenFGA.

This transformation has not been a smooth process: bringing together some thirty products and teams in a paradigm shift as profound as the transition to ReBAC, and convincing each one that the effort was worthwhile when the benefit is not always immediate for them, has been one of the most difficult challenges of this project.

Through this feedback, I would like to share:
  • Why permission systems are rapidly becoming a platform issue, not just an implementation detail.
  • How to reduce integration complexity through a unified API
  • Why a ReBAC model can better reflect the business than a classic RBAC.
  • How to gradually evolve a core service without a big bang approach — bringing around thirty products and teams into this paradigm shift, and convincing each one that the effort is worthwhile when the benefit is not immediate for them.
  • Linking Technology and Product: what gains can be expected in terms of security, stability and time-to-market.

Speakers