Bytedance·Software Engineer·Onsite - System Design / Architecture·Intermediate

IntermediatePrefer not to say

Apr 2026

Summary

Bytedance system design round for a software engineer role. One question, and I fumbled it pretty badly due to being out of practice with relational database modeling.

Questions Asked (1)

Design a role-based access control system using a relational database with entities for users, roles, permissions, and resources. How should these entities relate to each other?

System DesignData Modeling

Author's notes

I completely blanked on junction tables.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements and scale, then model the core entities and their relationships using a normalized schema with junction tables for many-to-many links. Explain how RBAC enforces access via role assignments and permission checks, and discuss trade-offs like performance and flexibility.

Pro tip: Mention that you'd consider adding a 'user_roles' table with optional expiration and a 'role_permissions' table, and discuss how to handle hierarchical roles or resource-specific permissions to show depth beyond basic RBAC.

1. Clarify Requirements and Scope

Ask about scale, whether roles can be hierarchical, if permissions are global or resource-specific, and if there are audit or temporal requirements. This ensures the design meets actual needs.

2. Define Core Entities and Attributes

Identify users, roles, permissions, and resources as primary entities. List key attributes for each, such as user_id, role_name, permission_action, and resource_type.

3. Establish Relationships with Junction Tables

Model many-to-many relationships: users to roles (user_roles), roles to permissions (role_permissions), and permissions to resources (permission_resources). Explain why junction tables are necessary.

4. Design for Access Control and Queries

Describe how to check if a user has permission to perform an action on a resource, likely via joins. Discuss indexing and query optimization for performance.

5. Address Extensibility and Trade-offs

Discuss optional features like role hierarchy, resource-specific roles, or attribute-based access control (ABAC) integration. Mention trade-offs between normalization and denormalization for read-heavy systems.

Key Points to Mention

Many-to-many relationships require junction tables (e.g., user_roles, role_permissions).
Permissions should be defined as actions on resources (e.g., 'read' on 'document').
Consider indexing foreign keys and frequently queried columns for performance.
Role hierarchy can be modeled with a self-referencing parent_role_id in the roles table.
For resource-specific permissions, include resource_id in the permission_resources table.
Discuss how to handle dynamic permissions or ABAC as an extension to RBAC.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.