Krishna Dey Work · Platform priority
OpenFGA Authorization Migration
An active migration of SpotDraft's authorization logic, currently scattered across application code and product areas, into OpenFGA, a relationship-based authorization system, without regressing existing access behavior.
Engineering Manager, Platform
Ongoing platform migration.
Challenge
Standing up a new authorization engine is the easy part. The hard part is proving that its decisions match the legacy system before it becomes the source of truth: a mismatch can mean either unauthorized access or an incorrect denial.
Approach
I set the staged rollout model: migrate existing relationships into OpenFGA, run it alongside the legacy system in shadow/comparison mode, log and investigate every mismatch, and only cut over a product area once confidence is high enough — with rollback and monitoring built into each phase rather than treated as an afterthought. I also pushed for faster bulk-migration mechanisms over slow row-by-row processing.
Outcome
This is an active platform migration. The 2026 Platform targets are to move all agreed authorization workflows to OpenFGA, keep decision mismatches under 0.5% during validation, complete rollout with zero P0/P1 authorization incidents, and retire the transitional dual-run flows once each scope is released.
What it taught
For a system this security-sensitive, the migration plan matters as much as the target architecture: shadow validation and mismatch logging are what make a cutover safe to trust.
More projects
All projectsA platform program to add explicit tenant identifiers to data models that currently infer workspace ownership through joins, and to move authentication from a one-user-one-workspace assumption to one identity across many workspaces.
Structured legal-request intake, first explored as a 2024 internal hackathon project with Sanket Mishra and Punit Batra, then built out through 2025 as a cross-functional squad I led, and shipped to production in January 2026 as the 'front desk of Legal' inside SpotDraft.
A configurable reverse-sync system for pushing contract and workflow data back into Salesforce, shaped to be extensible across triggers, conditions, object mappings, and future automation use cases.