← Atlassian Interview Insights
I started with the data model because that felt safest, laid out a users/groups/roles table and a separate permissions table linking subjects to resources.
Start by clarifying requirements and constraints, then design a unified authorization model that combines RBAC and ACLs, and finally discuss data modeling, enforcement, and trade-offs. Focus on how permissions are evaluated across multiple resource types and how to handle inheritance and scalability.
Pro tip: Emphasize the importance of a centralized authorization service with caching and a clear permission evaluation order (e.g., explicit deny > explicit allow > role-based allow) to balance security and performance.
Ask questions to understand scale, latency requirements, consistency needs, and whether permissions are hierarchical or flat. Identify key entities like users, groups, roles, resources, and actions.
Define a unified model that supports both RBAC (roles assigned to users/groups) and ACLs (direct permissions on resources). Consider using a policy language or graph-based representation to express permissions.
Propose a schema for roles, permissions, resource hierarchies, and ACL entries. Discuss storage choices (SQL vs NoSQL) and indexing for efficient lookups.
Describe how permission checks are performed at runtime, including inheritance, conflict resolution, and caching strategies. Consider a centralized service vs distributed enforcement.
Discuss trade-offs between flexibility, performance, and complexity. Address scalability concerns like caching, sharding, and eventual consistency.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by outlining the overall permission evaluation flow, then dive into the conflict resolution strategy. Emphasize a clear precedence order (e.g., explicit deny > explicit allow > role-based allow) and justify it with security and usability trade-offs. Use a concrete example to illustrate how your algorithm handles a conflict.
Pro tip: Mention that you log all permission decisions with the reason (e.g., 'denied by resource ACL') to aid debugging and auditing—this shows you think about operability, not just correctness.
Explain the sequence in which permissions are checked: first resource-level ACLs, then role-based permissions, with explicit denies taking precedence over allows.
Describe how you resolve conflicts: an explicit deny in an ACL overrides any role-based allow; if no explicit deny, an explicit allow in ACL grants access; otherwise fall back to role-based permissions.
Discuss how permissions propagate through resource hierarchies (e.g., project > repository) and how you merge ACLs and roles at each level.
Mention caching strategies (e.g., caching evaluated permissions per user-resource pair) and how you invalidate caches when permissions change.
Highlight the importance of logging decisions and writing comprehensive tests for edge cases, such as conflicting ACLs and role changes.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by clarifying the scope: are you designing a general authorization service or one for a specific product like Atlassian? Then outline the core resources (grants, permissions) and operations (grant, revoke, check). Propose a RESTful API design with clear endpoints, methods, and payloads, and discuss important considerations like idempotency, consistency, and scalability.
Pro tip: Emphasize the importance of idempotency for grant/revoke operations and the need for low-latency, high-throughput authorization checks. Mention that you would consider caching and eventual consistency trade-offs, especially in a distributed system like Atlassian's.
Ask clarifying questions to understand the context: Is this for a specific Atlassian product or a platform-wide service? What are the scale and latency requirements? Are there existing authorization models (e.g., RBAC, ABAC) to integrate with?
Identify the key resources: grants (user-resource-permission tuples) and permissions. Define the operations: grant access, revoke access, and check authorization. Consider batch operations for efficiency.
Propose endpoints like POST /grants for granting, DELETE /grants/{id} for revoking, and GET /authorization/check or POST /authorization/check for checking. Use appropriate HTTP methods, status codes, and payloads.
Discuss idempotency (e.g., using idempotency keys), consistency (strong vs eventual), caching strategies for authorization checks, and scalability (sharding, read replicas).
Ensure authentication and authorization for the API itself, use HTTPS, validate inputs, and return meaningful error responses (e.g., 400, 401, 403, 404, 409).
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by outlining a layered caching strategy for permission checks, including where caches live (client, service, database) and how they are invalidated. Then discuss the consistency trade-offs between strong and eventual consistency, especially when group memberships or roles change, and propose mechanisms to balance performance and correctness.
Pro tip: Emphasize that permission caching should be tied to the sensitivity of the operation—use shorter TTLs or synchronous invalidation for high-risk actions, and consider a hybrid approach with event-driven invalidation for near-real-time consistency.
Describe where permission checks can be cached (e.g., client-side, API gateway, service-level, distributed cache) and common strategies like TTL-based, write-through, or refresh-ahead.
Explain how changes to group membership or roles trigger cache invalidation, such as via events, webhooks, or database triggers, and how to propagate invalidation across distributed caches.
Compare strong consistency (e.g., synchronous invalidation, short TTLs) versus eventual consistency (e.g., longer TTLs, asynchronous invalidation) in terms of latency, load, and risk of stale permissions.
Suggest a hybrid approach that uses different caching policies based on operation sensitivity, and include monitoring and fallback mechanisms to handle invalidation failures.
Mention scalability, fault tolerance, and how to handle cache stampedes or thundering herd problems during invalidation, especially in a large-scale system like Atlassian's.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by acknowledging that edge cases are critical for a robust authorization system, then systematically walk through each category: deny overrides, inheritance, and real-time changes. For each, explain the challenge, propose a solution (e.g., explicit deny precedence, hierarchical evaluation, event-driven cache invalidation), and discuss trade-offs like consistency vs. performance.
Pro tip: Emphasize that deny overrides must be evaluated before allows, and that real-time group changes require a strategy for cache invalidation or event-driven updates to avoid stale permissions. Mention that Atlassian's scale demands a distributed, eventually consistent approach with careful conflict resolution.
Ask about the specific authorization model (RBAC, ABAC), scale, consistency requirements, and whether real-time enforcement is needed. This shows you understand the problem context before diving into solutions.
Explain that deny rules must take precedence over allows, and describe how to implement this (e.g., evaluate denies first, use explicit deny flags). Discuss how to handle conflicting rules and ensure deny overrides are consistently applied.
Describe how permissions propagate down resource trees (e.g., project > board > issue). Discuss strategies like recursive evaluation, materialized paths, or precomputed effective permissions, and how to handle overrides at lower levels.
Explain how to keep permissions up-to-date when users are added/removed from groups. Propose solutions like event-driven cache invalidation, short TTLs, or a pub/sub system to propagate changes, and discuss consistency trade-offs.
Summarize the trade-offs between consistency, latency, and complexity. Mention how you would test edge cases and monitor for issues in production, showing a holistic engineering mindset.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by clarifying the requirements and scope of the audit logging component, such as what events to log, retention policies, and compliance needs. Then propose a high-level architecture that ensures immutability, scalability, and efficient querying, and dive into data modeling and storage choices. Finally, discuss trade-offs and how the design integrates with the existing authorization system.
Pro tip: Emphasize that audit logs are often used for forensic analysis and compliance, so design for tamper-evidence and consider using append-only storage with cryptographic hashing. Also, mention the importance of separating audit logging from the main application flow to avoid performance bottlenecks.
Ask questions to understand what events need to be logged (e.g., authentication, authorization decisions, resource access), who will consume the logs, retention period, and any compliance standards (e.g., SOC2, GDPR).
Propose a schema for audit events that includes timestamp, actor, action, resource, outcome, and context. Consider using a structured format like JSON for flexibility and indexing.
Select a storage solution that supports high write throughput, immutability, and efficient querying, such as append-only logs, time-series databases, or cloud services like AWS CloudTrail. Discuss partitioning and indexing strategies.
Address how to guarantee log integrity (e.g., cryptographic hashing, write-once storage), access control for logs, and fault tolerance to prevent data loss.
Explain how the design scales with increasing log volume and how to support efficient queries for auditing and analysis, possibly using a separate analytics store or search engine.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.