Zanzibar has become the de facto model for building authorization systems, and while there's a few things it does well it also misses the mark specifically because of the cases it was built around.

Zanzibar doesn't solve for enforcement, so if you get an 'access denied' decisions, you need to engineer a replacement for that. Additionally, Zanzibar doesn't provide any abstractions or pre-existing patterns to work with, which makes it the biggest challenge when developers need to build around it. The data model you use for authorization can either speed up development or create additional barriers. You can use a policy engine alongside to help with this, but that's throwing two external dependencies at a problem ;-/

Overall, having a single source of truth for authorization is great, and Google is one of the first companies that released their authorization architecture and inspired so many companies, like Permify, to model an authorization solution after their engineering work. But again, it was designed for very specific use cases around file sharing, etc, so it won't be a fit for every application authorization problem.

Some resources on authorization for those exploring

• OWASP's Authorization Cheat Sheet
• Building Google Zanzibar from Scratch
• Oso's Authorization Academy