Panel Discussion: Authorization

The 90-90 rule mentioned by Taz Singh in software development refers to spending the first 90% of the time building the server and the last 10% on writing authorization rules, which paradoxically takes up another 90% of the time.

Guild.IO approaches GraphQL authorization by implementing role-based and attribute-based access checks. They ensure that users are authenticated and have the appropriate roles before accessing sensitive data, like hotel bookings or financial information.

Role-based access control (RBAC) assigns permissions based on user roles within an organization, allowing access to resources based on those roles. Attribute-based access control (ABAC) grants permissions based on policies that combine multiple attributes of users and resources, offering more granular access control.

Common challenges include managing the complexity of permissions as schemas evolve, ensuring data security while maintaining efficient data access and handling, and integrating authorization seamlessly with existing data systems without impacting performance.

Hasura handles GraphQL authorization using a built-in policy engine inspired by database systems with Row Level Security (RLS). This model allows specifying authorization policies at the model level, ensuring consistent application of security rules across all queries that touch the model.

The panel discusses several strategies including returning null for unauthorized fields, using GraphQL errors to indicate unauthorized access, and implementing role-based schema visibility where users only see parts of the schema they are authorized to access.

Organizations ensure consistency by using centralized roles and privilege management systems to define what actions a user can perform, which are validated both on the frontend for user experience and on the backend for security.