--- title: "complex" description: "Customer success story: NTWRK makes a complex access control system easy to manage with Cerbos" customer: "complex" website: "https://thentwrk.com/" canonical: "https://www.cerbos.dev/customers/complex" image: "/assets/use-case-files/social/ntwrk-case-study-url-thumbnail.png" source: "https://www.cerbos.dev/customers/complex" --- # Complex (NTWRK) makes a complex access control system easy to manage with Cerbos Using Cerbos to model, test, and implement roles and permissions, NTWRK operationalizes numerous edge case policies across a distributed architecture and streamlines policy maintenance. ## At a glance - Complex logic tested and verified before deployment - All application permissions managed from one place - Increased pace of development and faster app iterations > Cerbos has removed an entire stress point for me around distributing permissions in general. > > — Steve High, Staff Engineer, NTWRK ### Summary Complex (NTWRK) is a premier live-streaming video commerce platform on web and mobile. They serve millions of sneaker aficionados, trading card collectors, and enthusiasts of various other niches. Cerbos is an open-source authorization layer that decouples permissions logic from the core application. Development teams use Cerbos to make permissions and access control more scalable and easier to manage. NTWRK used Cerbos to reliably solve complex use cases in their permissions structure, and position their team for agile growth. [Watch the video](https://www.youtube.com/watch?v=0dthAn_n7ao) ## Introduction ### A fast-growing business with outdated software architecture At NTWRK, business growth was accelerating, and the development team knew they needed to iterate faster going forward. To do that, NTWRK was on a mission to break their monolithic software architecture into more agile, scalable components. It was in service of that mission that Steve High, Staff Engineer at NTWRK, went looking for an authorization solution. He needed to find something he could implement fast, as the business wasn’t going to slow down and wait for him. But he also had specific requirements he needed to meet. ## Business needs ### Improve both user experience and developer experience Authorization is a critical component of any application. NTWRK in particular has specific and complex needs for their access control policies. Their user base includes shoppers, sellers, brands, administrators, and a range of others who interact with their platform. The business cannot operate without this layer of user management and security. **“We have numerous edge cases regarding permissions, which often led to oversights when making changes, resulting in disasters,”** says Steve High, “We have been introducing all kinds of new roles to our administration and we needed not only role-based access control (RBAC), which is kind of the easy part, but also the fine-grained tuning of permissions.” To deliver a seamless user experience, NTWRK needed to centralize access controls across distributed services securely and reliably. To maintain a fast pace, their access control system needed to be easy for the development team to update and maintain. They knew that in the long term, authorization requirements would be likely to change and grow more sophisticated. - **Account for numerous edge cases** - **Accommodate ongoing changes to permissions and business logic** - **Centralized, scalable authorization to help the dev team move faster** ### Evaluating solutions: The importance of compatibility Steve recognized that a third-party access control solution would likely be the best option for NTWRK. Using a third party would allow them to centralise their authorization policies and streamline updates. However, he also wanted to avoid compromising on his requirements, and needed to find something that would fit exactly right. AWS Cognito, for example, would have required several infrastructure changes to adapt NTWRK to the way Cognito works. Given that one of their primary objectives was to speed up development, that option was not going to work for them. “We were examining AWS Cognito for a while. Cognito is a very good solution, but you have to position your infrastructure a certain way. Otherwise, it becomes a thing that you’re constantly fighting.” ## Solution ### Modeling requirements before production and seamless implementation When Steve began test-driving Cerbos, he carefully weighed its capabilities against each of his business requirements. #### Accounting for edge case permissions Steve was particularly pleased with the Cerbos Playground, which allowed him to test all of his use cases before pushing anything to production. He know his permissioning requirements might be complex for a third-party app to handle. So he held nothing back, wanting to be as thorough as possible before deciding. “I've thrown some pretty gnarly attributes at Cerbos, and Cerbos gets it right every time,” Steve reports. He was impressed by Cerbos’ adaptability to complex edge cases. It gave him confidence that Cerbos could handle any future changes to their permissioning with ease. **“It used to be that somebody on the product team goes to change something, and we forgot to change it in 9 of 10 places. So it was always a disaster. With Cerbos, we have one repo of policies. That's all you have to worry about.”** “Cerbos has removed an entire stress point for me around distributing permissions in general.” Steve says. > I've thrown some pretty gnarly attributes at Cerbos, and Cerbos gets it right every time. > > — Steve High, Staff Engineer, NTWRK #### Centralized, scalable authorization to help the dev team move faster It was important for Steve to consider how Cerbos would fit into both NTWRK’s architecture and their workflows. It had to be easy to implement and easy to onboard developers. And once everything was set up, he needed to know how much work it would require to regularly maintain it. Opting for a sidecar approach for performance and safety considerations, Steve found it impressively fast and easy to set up his authorization through Cerbos. “**Cerbos is plug and play. If you're a decent developer, you can get Cerbos up and running in minutes.** There's not a ton of configuration and all the configuration there is, fits in one nice little file.”, Steve explains, “I can onboard a new developer onto Cerbos in an hour.” With Cerbos set up, the NTWRK team only interacts with it to periodically check policies for consistency. As a result, Steve and his colleagues have freed up more time to create features that delight their users. **“Throwing the entire concern of authorization across to Cerbos really did increase my velocity, which in turn increases velocity downstream from me. It has allowed the team to deliver top-tier user experience and concentrate on faster app iterations.”** #### Related links - Full interview with Steve High - Utility Warehouse synchronizes authorization across 4,500 services - Cerbos helps Salesroom save over $1MM worth of developer time #### Learn more about Cerbos - Building application permissions with Cerbos - Cerbos Playground - Scalability - SDKs and integrations - Permissions-aware data filtering