pemba
Embedded Authorization Engine
Open Source - Joshua Fields — Creator & Sole Engineer
pemba Case Study
pemba is an open-source, embedded, Zanzibar-style relationship-based (ReBAC) authorization engine written in Rust with Python bindings. It studies the design of SpiceDB, but instead of running as a separate service it runs in-process, inside the application that needs the permission checks. The name comes from Pemba Island in the Zanzibar archipelago — a nod to Google's Zanzibar paper — and home of the endemic Pemba flying fox.
Problem
Authorization services like SpiceDB need their own deployment and add a network hop to every check. Relationship writes also can't share a transaction with application data, so the permission store and the application database can drift apart. pemba was built to remove that gap: engine.write(..., conn=...) joins the application's own SQLite transaction, so permission changes commit atomically with application rows.
Role
As Creator & Sole Engineer, I designed and built pemba end to end. It builds on my experience as Monstro's sole developer of their SpiceDB permissions system.
Architecture
- Transactional writes:
engine.write(..., conn=...) joins the application's SQLite transaction, so relationship changes commit or roll back together with application data.
- Schema language: A parser, validator, comment-preserving formatter, and CLI for defining resource types, relations, and permissions.
- Query API:
check, lookup_resources, and lookup_subjects.
- Storage: An in-memory store and SQLite stores — a native one, and one that runs over Python's
sqlite3 connection.
- Consistency: MVCC read snapshots.
- Cycle-safe evaluation: Strongly-connected-component (SCC) fixed-point evaluation bounds check cost on cyclic relationship data and fails closed.
- Python bindings: PyO3 and maturin, abi3 wheels, typed stubs, and
mypy --strict.
- Verification: Property tests against a reference evaluator, differential tests against SpiceDB with documented known differences, fuzz targets, and a benchmark harness against SpiceDB.
Stack
Rust for the engine; Python bindings via PyO3 and maturin with abi3 wheels and typed stubs; SQLite and in-memory storage; property-based testing, differential testing against SpiceDB, fuzzing, and a SpiceDB benchmark harness.
Outcome / Impact
pemba is pre-0.1 and installs from source; it is not yet published to PyPI or crates.io. It demonstrates that Zanzibar-style authorization can run embedded in an application, with permission writes that share the application's transaction instead of drifting from it, backed by a verification suite that checks its behaviour against both a reference evaluator and SpiceDB.
Tags: pemba, rust, python, pyo3, maturin, sqlite, authorization, rebac, zanzibar, spicedb, permissions, property-based testing, fuzzing, differential testing, open source, OpenSource
View on GitHub | Building pemba Article | SpiceDB Authorization Article | GitHub | LinkedIn
Joshua Fields — full portfolio
