Krishna Dey Work · Platform priority
OpenFGA Authorization Migration
An active migration of SpotDraft's authorization logic, currently scattered across application code and product areas, into OpenFGA, a relationship-based authorization system, without regressing existing access behavior.
Engineering Manager, Platform
Ongoing platform migration.
Challenge
Standing up a new authorization engine is the easy part. The hard part is proving that its decisions match the legacy system before it becomes the source of truth: a mismatch can mean either unauthorized access or an incorrect denial.
Approach
I set the staged rollout model: migrate existing relationships into OpenFGA, run it alongside the legacy system in shadow/comparison mode, log and investigate every mismatch, and only cut over a product area once confidence is high enough — with rollback and monitoring built into each phase rather than treated as an afterthought. I also pushed for faster bulk-migration mechanisms over slow row-by-row processing.
Outcome
This is an active platform migration. The 2026 Platform targets are to move all agreed authorization workflows to OpenFGA, keep decision mismatches under 0.5% during validation, complete rollout with zero P0/P1 authorization incidents, and retire the transitional dual-run flows once each scope is released.
What it taught
For a system this security-sensitive, the migration plan matters as much as the target architecture: shadow validation and mismatch logging are what make a cutover safe to trust.
More projects
All projectsA platform program to add explicit tenant identifiers to data models that currently infer workspace ownership through joins, and to move authentication from a one-user-one-workspace assumption to one identity across many workspaces.
Native integration and platform work spanning CRM, procurement, and collaboration systems, with emphasis on reusable primitives, metadata-aware design, and integration surfaces that stay coherent as the catalog expands.
ClickWrap captures recorded acceptance of terms in-product — a checkbox, link, or agreement viewer on a website, app, or signup flow — without sending the agreement through a full negotiation and e-sign ceremony. We explored that product shape as a 2023 hackathon with Sanket Mishra and Punit Batra; another team later shipped it. The shipped product has had more than $1M in revenue impact.