At a company like Booking.com, every sensitive field in the GraphQL schema has more than one team with a legitimate claim on it — Security, Identity, Legal, Privacy, Data Governance, the Traffic Gateway, the Federation Platform, and the hundreds of domain teams that own the data itself. When that many stakeholders need to agree on what "authorized" means for a single field, you don't have a security problem; you have a coordination problem. And solving it as security only makes it worse.This talk shares how we turned that coordination problem into a contract using a single federation directive — @policy. Domain teams author rules for the data they own. Privacy and Identity contribute cross-cutting concerns. Other domains compose by reference instead of re-authoring. The router is the only place enforcement happens. One audit trail. No cross-team meetings.
What you'll learn:
- Why multi-stakeholder access control is a coordination problem, not a security one
- How @policy becomes the coordination contract between domain teams, cross-cutting authorities, and the federation platform
- The single-enforcement-point + bounded-authorship + free-reuse architecture — and how it lets new teams adopt without coordination overhead
