Materialized ReBAC for Zero‑Latency Reads

The article describes an approach to Relationship-Based Access Control (ReBAC) that avoids the read-time latency of centralized, Just-In-Time (JIT) engines (e.g., Google Zanzibar) by materializing permissions ahead-of-time (AOT). On relationship or configuration changes the system runs background hydration jobs that traverse a project's graph using a pluggable GraphNavigator, evaluate conditions via ConditionHandler plugins, and execute actions through a Command-style Action executor to write permissions or activate modules directly into target entities' records. This yields constant-time authorization checks at API read-time (simple local DB object checks), faster testing via isolated engine vs plugin tests, and governance features such as Terraform-style dry runs, human review of pending changes, correlation-id atomic rollbacks, audit logs, and cycle/depth protections. The design aims to combine ReBAC's expressiveness with sub-millisecond read performance and predictable governance.