Feedback needed: ACL as a service
Hi All -
My team has built an integration for one of the customers, that allows doing (what I call) an "ACL as a service".
Our customer uses Web service to manage its operations.
We have built an integration that does:
-
control who has access to specific buttons/actions, i.e. customer wanted to limit who can cancel the order, or replace it with a new one (only certain employees) (see example attached)
-
logs/audit of actions done, time and when (pretty much an audit trail) (another example attached)
-
Zapier integration based on the button/event (when the button is clicked, email is sent or Slack message is sent)
Since then, our customer abandoned any plans on adding any ACL or audit functionality and continues to use our integration for a variety of use cases.
My team is considering productizing it to the public, so I'm looking for feedback and any suggestions of use cases, verticals, and "perfect customer" profiles that might make it worthwhile. I'd really appreciate it.
Thanks!
I was looking into doing something like this at one point. You could even include a Lua interpreter and do complex rules for policy based access control (PBAC)
I guess we went into a little more complicated rout but ending up so full featured RBAC.
I think this is important why team believe into a worthwhile for others but we are trying to define a profile of a customer.
Very cool! ACL is an important concern in many enterprise systems, and can get very complex very quickly. Its importance start to show up with different classes of users (i.e. roles), and the people that cares about the most are 1) the admins, and 2) the devs who need to implement them.
The biggest challenge I see with a service like this is the complexity of the space. ACL needs to be "administerable", i.e. via mapping users, roles, permissions, hierarchies, etc. This is because people usually only identify such needs when they have fairly complex use cases, so chances are you will only come across the hard ones.
My 2 cents. Hope it helps.
That was exactly how this evolved from a simple workaround into something a complex as groups, segments, timed permissions etc.
However it’s totally focused on our current customer and the service they are using. This is the current challenge of productization of it to identify the customer profile for this service.
ACL is a general capability, so I think your customer profiles would be "developers who are building complex applications from scratch and don't want to deal with ACL management".
I see this as very similar to Auth0 but dealing with ACL instead of identities.