YOUR BRIEF
What to work through
Work through a permission system as a spoken system design interview. Start by clarifying the scope, sketch a working design and explain the trade-offs behind your choices.
- Give users and groups a role in a workspace, such as admin, editor or viewer
- Share one page or folder with a person or a group, at a chosen level
- Nested pages inherit access from their parent unless an override is set on them
- Check whether a user may read, edit, share or administer a resource, on every request
- List who has access to a page and why, and revoke it
BEFORE YOU START
Constraints to discuss
- Checks are fast: Google’s Zanzibar answers over 95% of them within 10 ms
- Highly available: Zanzibar reports over 99.999% across three years
- A removed user never sees content added after the removal
- Checks and reads outnumber permission changes by about a hundred to one
- Every grant and revoke is kept in an audit log
Need a starting point?
Watch for these common gaps as you prepare:
- Each service checking permissions with its own copy of the rules
- Copying grants onto every child page, so moving a folder or removing a person rewrites thousands of rows
- A cache of check results with a long expiry and no versions, so a removed user keeps access
- Ignoring groups inside groups
- No answer for which wins when a page has an override and its parent a broader grant
Why this question is in the collection
These sources connect the problem to company interview reports or preparation guides. They do not guarantee what a company will ask you.
- Atlassian: PracHub lists an Atlassian onsite report from January 2026: an access control system with roles, grants on single pages and issues, inheritance down a hierarchy and a check API.
- Notion: Final Round AI’s Notion guide lists a workspace permission system with inherited and overridden access among the questions that come up in Notion onsite rounds.
- Airtable: Design Gurus’ Airtable guide lists permissions and sharing for bases, workspaces and collaborator roles among the question types candidates report.
- Stripe: Aced’s Stripe guide, built from candidate and interviewer reports, lists redesigning an internal authorization system across services, sized by service count and requests a second.