← Atlassian Interview Insights

Atlassian·Software Engineer·Onsite - System Design / Architecture·Senior

SeniorPrefer not to say
May 2026

Summary

Atlassian system design round, one big question that sprawled into a lot of sub-topics. The scope was broader than I expected and I felt like I was playing catch-up the whole time.

Questions Asked (1)

Q1

Design an authorization system that supports both role-based access control and resource-level permissions, covering the data model, permission evaluation logic, caching, and scaling to billions of checks per day.

System DesignData ModelingTechnical Trade-offs
Author's notes

I started with the data model which felt safe, users, roles, permissions, resources, the join tables.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements: define roles, resources, actions, and the scale (billions of checks per day). Then propose a data model with RBAC and resource-level permissions, and describe an evaluation engine that combines both, with caching and sharding for scalability. Finally, discuss trade-offs and optimizations.

Pro tip: Emphasize that authorization decisions should be fast and consistent; consider using a policy decision point (PDP) with a policy engine like OPA or a custom one, and cache decisions with short TTLs to handle scale while maintaining freshness.

1. Clarify Requirements and Scale

Ask about the types of resources, actions, roles, and the expected number of checks per day. Confirm latency requirements and consistency needs.

2. Design the Data Model

Define entities: users, roles, permissions, resources, and resource-level ACLs. Consider a graph model or relational tables with efficient indexing.

3. Define Permission Evaluation Logic

Describe how to combine RBAC and resource-level permissions: e.g., check role permissions first, then resource-specific overrides. Use a policy evaluation engine.

4. Implement Caching and Scaling

Cache decisions at multiple levels (client, service, distributed cache) with appropriate TTLs. Shard the authorization service and use read replicas for the data store.

5. Discuss Trade-offs and Optimizations

Address consistency vs. latency, cache invalidation strategies, and how to handle billions of checks with horizontal scaling and efficient data structures.

Key Points to Mention

  • RBAC model with roles, permissions, and role hierarchies
  • Resource-level permissions (ACLs) and how they interact with roles
  • Policy evaluation engine (e.g., OPA, custom) and decision caching
  • Caching strategies: local cache, distributed cache (Redis), TTL and invalidation
  • Sharding and partitioning of authorization data for scalability
  • Trade-offs: consistency vs. performance, cache staleness, and failure modes

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.