Operations Guide
Recommended cache stores in production
ABAC evaluation is read-heavy and benefits from a shared cache across app instances.
- Redis: best for horizontally scaled apps; low latency and shared state.
- Database cache: acceptable default when Redis is unavailable; simpler operationally.
- File/array stores: only for local development and tests.
Redis vs database tradeoffs
- Redis pros: lower latency, better throughput, natural fit for frequent invalidation.
- Redis cons: extra infrastructure and monitoring.
- Database pros: no extra service, easier onboarding in smaller deployments.
- Database cons: higher latency and additional load on primary DB.
Rollout guidance for unmatched routes
Use ABAC_ALLOW_IF_UNMATCHED_ROUTE as a temporary rollout lever.
- Start with
ABAC_ALLOW_IF_UNMATCHED_ROUTE=trueduring initial route mapping. - Add
resource_patternscoverage for all protected routes and monitor policy misses. - Validate deny/allow behavior in staging with realistic traffic.
- Set
ABAC_ALLOW_IF_UNMATCHED_ROUTE=falsebefore production hardening signoff.
Enterprise-safe defaults
For strict environments, use:
ABAC_DEFAULT_POLICY_BEHAVIOR=denyABAC_ALLOW_IF_UNMATCHED_ROUTE=falseABAC_CACHE_INCLUDE_CONTEXT=trueABAC_CACHE_STORE=redis(ordatabasewhen Redis is unavailable)
Bulk writes and cache invalidation
During large seed/import operations, frequent ABAC model writes can trigger repeated cache flushes.
- Default behavior:
ABAC_CACHE_FLUSH_ON_WRITE=true(flush after create/update/delete on ABAC models). - Bulk mode: set
ABAC_CACHE_FLUSH_ON_WRITE=falsefor the batch window to avoid flush storms. - After bulk updates: re-enable write flushes and perform a single cache flush through your app service container.
Optional metrics hooks
For custom telemetry (evaluation count/latency/cache hit ratio), bind your own
zennit\ABAC\Contracts\MetricsCollector implementation.