The breach is a missing check. The outage is the checker.

Reconstructs the authorization layer from the accounts of Google, Airbnb, Carta, Netflix, Figma, Slack and Gojek: relationship tuples, precomputed indexes, caches with a consistency story, and the fail-open choice at the enforcement point. Then reads the failure record, from the ACMA's case against Optus and the NYDFS order against First American to Google Cloud's June 2025 outage, and shows the losses cluster at the two poles the elegant architecture does not advertise: the check that was never made, and the checker whose crash is the outage.

What you get out of it

• Published breaches are absent checks (Optus, First American, the OWASP BOLA class); published outages are present checkers failing closed (Google Cloud, June 2025). Design reviews must interrogate both poles, not the policy model.
• Every fast check is a precomputed answer: Airbnb fans out at write time, Google flattens groups into the Leopard index, and both hold p95/p99 near 10 ms only because traversal happens before the question arrives.
• The consistency machinery is the least-adopted part of the Zanzibar design; most deployments run eventually consistent with an unmeasured staleness window, which is a security parameter nobody writes down.
• Fail-open versus fail-closed is per-check-class configuration, not doctrine: Envoy defaults closed, Kubernetes makes it per-webhook, and Google moved Service Control toward fail-open only after the June 2025 outage.
• List endpoints are a different operation from point checks: OpenFGA bounded ListObjects by design, Cedar rejected batched checks as misplaced optimisation, and AuthZed's case file shows the storm that arrives when a list screen uses a point-check API.

Scope

Why this, now. Google Cloud's June 2025 Service Control outage put the fail-open question on every design review agenda, while the Zanzibar-clone ecosystem (SpiceDB, OpenFGA, Keto) is now mature enough that its design records and open issues show exactly which parts of the paper the industry adopted and which it quietly postponed.

What it does not cover. Authentication and session management, secrets and workload identity (covered by the 2026-09-09 build-pipeline guide), database row-level security, and the organisational design of role hierarchies.