Atlassian·Software Engineer·Onsite - System Design / Architecture
Jun 2026
Atlassian system design round focused entirely on building an authorization system from scratch, combining RBAC and ACL patterns. Pretty deep dive, they wanted the full picture: schema, evaluation logic, APIs, caching, audit logs. Left feeling like I covered maybe 70% of what they were actually looking for.
- Design an authorization system that supports both role-based access control (RBAC) and resource-level ACLs, working across multiple resource types like spaces, pages, projects, and issues.
- Walk through your permission evaluation algorithm. How do you resolve conflicts between role-based permissions and resource-level ACLs?
- What REST APIs would you expose for granting and revoking access, and for checking whether a user is authorized to perform an action?
- How would you handle caching for permission checks, and what are the consistency trade-offs when group membership or roles change?
- What edge cases would you need to handle, such as deny overrides, permission inheritance across resource hierarchies, and real-time group membership changes?
- How would you design the audit logging component for this authorization system?
“I started with the data model because that felt safest, laid out a users/groups/roles table and a separate permissions table linking subjects to resources.” The rest of the author's notes on Software Engineer interview at Atlassian, Onsite - System Design / Architecture round, covers how they worked through the question, what the panel pushed back on, and what they would do differently.
View Post