Efficient Permission Resolution with Caching
Last updated: December 9, 2025
Quick Overview
Given a hierarchical IAM structure (organization -> accounts -> groups -> users) with permission inheritance and overrides, implement efficient permission resolution that determines the effective permissions for any user on any resource.
Wiz
December 9, 20255
6
4,866 solved
Given a hierarchical IAM structure (organization -> accounts -> groups -> users) with permission inheritance and overrides, implement efficient permission resolution that determines the effective permissions for any user on any resource.
Cloud IAM permissions are hierarchical and complex. A user's effective permissions come from direct assignments, group memberships, account-level policies, and organization-level policies, with inheritance and explicit denials. Efficiently resolving the effective permissions is critical for Wiz's access analysis. This problem tests your ability to design algorithms for hierarchical data with caching.
What the Interviewer Expects
- Model the hierarchical permission structure correctly
- Implement permission resolution with proper precedence (explicit deny > allow)
- Add caching to avoid re-computing permissions for repeated queries
- Handle cache invalidation when permissions change
- Analyze time and space complexity
Key Topics to Cover
How to Approach This
- Clarify input constraints and edge cases before writing code.
- Walk through your approach verbally and confirm with the interviewer before coding.
- Start with a brute force solution, then optimize. Mention time and space complexity.
- Test your solution with examples, including edge cases like empty input or duplicates.
- Consider common patterns: sliding window, two pointers, hash map, BFS/DFS, dynamic programming.
Possible Follow-up Questions
- How would you handle permission boundaries (AWS SCPs)?
- What cache invalidation strategy would you use when an org-level policy changes?
- How would you parallelize permission resolution for millions of users?
Sharpen Your Skills on Codemia
Practice similar problems with our interactive workspace, get AI feedback, and track your progress.
Practice DSA ProblemsSample Answer
Permission Model
```python class PermissionResolver: def __init__(self): self.hierarchy = {} # child -> parent self.policies = {} # entity -> ...
Cache Invalidation
When a policy changes on entity E, invalidate cache entries for: 1. E itself 2. All descendants of E in the hierarchy (they inherit from E) Use a rev...
Submit Your Answer
