tl;dr:Google Zanzibar powers authorization for hundreds of Google’s apps so you might think it's a great model for your authorization service. But does Zanzibar's promises of scale, high availability, strong consistency mean that it’s the right solution for the rest of us? Zanzibar's defining characteristic is actually centralization, which is a massive tradeoff that’s not practical for most. The Googles of the world can pull it off, but is there a Zanzibar for the rest of us?