Design an access control system (RBAC + resource-based)
Company: Atlassian
Role: Software Engineer
Category: System Design
Difficulty: medium
Interview Round: Onsite
Design an authorization system that supports both:
- **Role-Based Access Control (RBAC)**: users/groups have roles (e.g., Admin, Editor, Viewer) that grant permissions.
- **Resource-based permissions (ACLs)**: individual resources can grant permissions directly to users/groups (e.g., a specific page shared with a user).
Requirements:
- Support common actions: `read`, `write`, `delete`, `share`, `admin`.
- Must work across multiple resource types (spaces, pages, projects, issues).
- Provide APIs to grant/revoke access and to check authorization.
- Discuss policy evaluation, data model, caching, and audit logs.
Deliverables:
- Core entities and schema.
- Permission evaluation algorithm.
- REST APIs.
- Edge cases (deny overrides? inheritance? group membership changes?).
Overview: This question evaluates a candidate's ability to design a scalable authorization system incorporating RBAC and resource-based ACLs, testing competencies in access-control models, data schema design, policy evaluation, API design, caching strategies, and audit logging.
Read the full Atlassian Software Engineer interview experience this question came from