Choosing Between FULL and ZONKED Consistency Levels in SpiceDB

Decision and Constraints

When configuring SpiceDB permission checks you must choose a consistency model that matches your application’s tolerance for latency versus permission staleness. The decision hinges on two constraints: the maximum acceptable delay for a permission decision and the cost of granting a permission that has just been revoked.

Comparison of Supported Options

Option	Read Source	Typical Latency	Staleness Risk
FULL	Serializable read from the leader node	Higher, especially under heavy write traffic due to lock contention	None – the result reflects all committed writes before the check
ZONKED	Eventual read from a follower replica	Lower – reads are served by a replica that can lag behind the leader	Possible – a revocation may not yet be visible, allowing a temporarily stale ALLOWED

Trade‑off Explanation

FULL guarantees that every permission check sees the latest state of the system. This comes at the cost of increased query latency and higher CPU usage on the leader when many concurrent writes are occurring, because the leader must serialize reads with writes.

ZONKED reduces latency by directing the check to a follower replica that may be slightly behind the leader. The trade‑off is a window where a permission that has just been revoked can still be evaluated as ALLOWED, which may be unacceptable for security‑critical operations.

Implementation and Validation Example

1. Start a local SpiceDB instance (requires Docker and network access to port 50051):

   docker run -d -p 50051:50051 authzed/spicedb:latest

2. Load a simple schema (e.g., a document with a view relation) and insert a tuple granting user:alice the view permission on document:doc1. This can be done via the SpiceDB CLI or gRPC; the exact command depends on your installation.
3. Perform a permission check with strong consistency and measure latency:

   time spicedb permission check --consistency=FULL user:alice view document:doc1

   Record the output (ALLOWED or DENIED) and the time reported by the time command.
4. Repeat the same check with eventual consistency:

   time spicedb permission check --consistency=ZONKED user:alice view document:doc1

   Again note the result and latency.
5. Immediately after adding a tuple that revokes the permission (e.g., spicedb tuple delete user:alice view document:doc1 or the equivalent write), run both checks again. The FULL check should now return DENIED, while the ZONKED check may still return ALLOWED if the follower has not yet applied the revocation, demonstrating the staleness window.
6. To verify the observation, you can query the follower’s lag (if your deployment exposes replication metrics) or simply wait a few seconds and re‑run the ZONKED check; it should eventually transition to DENIED.

Limitations and Practical Checks

• The validation assumes a single‑leader, multi‑follower topology; in a pure single‑node deployment ZONKED behaves like FULL.
• Measuring latency with time includes command‑startup overhead; for precise profiling use a dedicated benchmarking tool.
• Ensure the CLI version matches the server version (SpiceDB v1.x) to avoid incompatibility errors.
• Running the example modifies the database state; if you need to revert, delete the test tuples or restart the container.