The problem
In a growing product, permissions pile up: a role here, an exception there, a missing check on one screen. Nobody really knows who can do what anymore, or why.
The day an access must be removed, the question becomes urgent. A revocation that takes hours to apply is not a revocation. And a decision that cannot be explained is not a decision: it is a bet.
Why it is hard
The symptoms are familiar:
- rights that are too broad, because nobody dares to tighten them;
- features slowed down by the fear of breaking an access;
- incidents that cannot be reconstructed;
- and the same authorisation logic rewritten in every product.
What we are building
One place to decide, applied everywhere: rights, identities, secrets and the trace of every decision. Revocation applies within seconds, even when volume means the same answer cannot be requested again on every screen.
The rule we hold: the inputs of a decision may be cached, never the verdict. A frozen authorisation is a breach waiting for its moment.
What changes
- an access is removed in seconds, not days;
- every decision can be justified;
- product teams stop reinventing authorisation.
What comes next
This is being built at Grantity R&D, the lab. The topic is thankless, but this is exactly where trust and compliance are decided.
Do you live with this problem? Let’s talk.