How Calendly Standardized Authorization to Power AI Innovation
Calendly’s expansion beyond scheduling into AI-driven products like Notetaker created a natural inflection point to consolidate authorization practices, setting the stage for faster, more secure product development built for the pace of AI product development. The company needed a solid platform for growth. Calendly adopted SpiceDB to standardize access control, decrease latency, and create a shared authorization platform.
The Challenge: Fragmented Authorization
Calendly’s authorization logic had grown organically, with different teams solving access control in different ways across different parts of the platform. According to Rajesh Hariharan, Engineering Leader for Platforms at Calendly. “Different parts of the platform were solving access control in different ways, which created both security risk and engineering friction.”
When Calendly began working on AI-driven products, ad hoc authorization became a non-starter. Calendly was moving its Notetaker AI assistant from a single-user experience to team collaboration, which meant sharing meeting recaps with individuals, groups, an entire workspace, and eventually external recipients through authenticated access. That shift exposed the limits of ad hoc authorization immediately.
“Once you introduce those patterns, ad hoc authorization logic starts to break down quickly,” Rajesh said. “You need inheritance, delegation, and a model that can evolve cleanly as the product evolves.”
Rajesh Hariharan, Engineering Leader for Platforms, Calendly
The Solution
Calendly began their authorization search by evaluating three paths: extending their current solution, building a bespoke authorization system from the ground up, or evaluating a third-party, Zanzibar-based system. Their requirements were substantial.
According to Rajesh, “Our primary requirement was not just storing permissions, but modeling authorization as relationships that can be evaluated consistently across services. We needed a clean way to express direct ownership, shared access, group and organization inheritance, parent-child propagation, and eventually conditional access patterns when needed. We also cared about strong consistency, low-latency checks, and a schema model that would let us evolve without constantly redesigning resource-specific permission tables.”
Rajesh Hariharan, Engineering Leader for Platforms, Calendly
When Calendly evaluated SpiceDB, Jon Casey, Senior Engineer at Calendly “decided our engineering effort was better spent integrating a proven system than reinventing one.” He noted that in addition to meeting their relationship modeling needs, “SpiceDB fit our rollout strategy. We could dual-write, backfill, switch reads, and cut over progressively instead of forcing a high-risk rewrite.”
Ultimately, Calendly landed on SpiceDB for five reasons:
1.A proven model
A Zanzibar-inspired approach, rather than continuing to extend homegrown logic in different directions.
2.Clean relationship modeling
Direct access, inherited access, group-based access, and parent-child resource patterns, all expressed natively.
3.Authorization as a platform, not a one-off
A shared capability other teams could build on, instead of each service reinventing its own ACL model.
4.Consistency and performance at scale
Strong consistency and low-latency permission checks that could grow with Calendly as a multi-product company.
5.A practical path forward
The open-source, self-hosted route let the team move immediately while leaving the door open to more advanced managed capabilities later.
Implementation: A Focused Pilot
For its pilot, Calendly chose to use self-managed SpiceDB, though Rajesh notes that features in AuthZed’s managed offering could also be part of the future. “We are very conscious that list/search and materialized permission views may eventually push us toward additional managed capabilities as adoption scales.”
To limit the scope of its pilot project, Calendly chose Notetaker recap sharing as its first production use case. The team specifically chose a use case that required permission checks but not authz-aware list/search, since listing is one of the more complex challenges in relationship-based authorization. This scoping allowed Calendly to validate the operational model, schema patterns, tooling, and rollout strategy before tackling richer, more complex use cases.
- Timeline
Pilot planning began in late 2025. Schema design, SDK work, infrastructure setup, and dual-write/backfill planning moved through early 2026. The Notetaker recap-sharing pilot is now complete and GA.
- Architecture
Calendly self-hosts open-source SpiceDB in its Kubernetes environment, backed by Postgres, with schema and configuration managed centrally in a dedicated SpiceDB repository. The service writes and checks relationships in SpiceDB rather than relying on legacy access state stored in the application database.
- Challenges along the way
Migration discipline was critical - feature flags, backfill jobs, staged enablement, and careful latency monitoring ensured existing recap-sharing behavior stayed stable while SpiceDB became the new source of truth. As the team looked past the initial pilot, they also identified the need for foundational global relationships, such as organization membership and user-group membership, inside SpiceDB to unlock richer sharing patterns.
“The difficult part was not getting SpiceDB running,” Rajesh said. “It was designing a paved path for adoption that future teams can reuse safely.”
Rajesh Hariharan, Engineering Leader for Platforms, Calendly
The Results: Successful GA and More Responsive Engineering
Engineering Impact: A Platform Mindset
Beyond the pilot itself, SpiceDB has changed how Calendly’s engineers approach authorization as a discipline.
“Engineers are starting to think of authorization as a graph and a shared platform capability, not as scattered checks inside controller logic or SQL queries,” Jon said. “Instead of every team inventing a new table shape or permission heuristic for each feature, we now ask a more disciplined set of questions: what are the resources, what relationships exist, what actions do those relationships grant, and where should inheritance happen.”
Jon Casey, Senior Engineer, Calendly
SpiceDB is a critical piece of Calendly’s engineering ambitions. “As we expand into AI, Notetaker, and broader multi-user workflows, authorization becomes a core platform capability,” Rajesh said. “SpiceDB gives us a durable foundation for that next phase.”
That shift shows up directly in engineering focus. “Teams can spend more time on product behavior and less time inventing authorization infrastructure. By standardizing on SpiceDB, we can provide a consistent schema review model, a shared SDK approach, and a repeatable migration pattern. That reduces long-term cognitive load and lowers the odds that each team solves the same problem differently.”
Results
Notetaker launched successfully, with SpiceDB now powering authorization for meeting recap sharing. Jon has referenced initial response times “in the roughly 25-30 ms range,” and also noting that “we now have the core platform pieces in place to onboard additional authorization use cases instead of repeating one-off implementations.”
According to Rajesh, “The bigger ROI is strategic. Authorization is one of those areas where fragmented local solutions create hidden cost everywhere: slower feature delivery, harder reviews, inconsistent behavior, and more security risk. Standardizing early is a compounding investment.”
That foundation is already translating into product responsiveness. “It gives us a more credible path to support the kinds of access models the business increasingly needs as Calendly becomes a multi-product platform,” Rajesh said. In Notetaker alone, the roadmap extends from the initial launch into group sharing, workspace-wide sharing, shared folders with inherited access, and authenticated external access through lite accounts.
While Calendly focused on self-managed SpiceDB for their initial launch, they acknowledge the value of AuthZed’s managed services for the future. Per Rajesh, “the open-source/self-hosted path gave us a practical way to move now, while keeping the door open for more advanced managed capabilities later if our needs grow.” He noted that Calendly was “very conscious that list/search and materialized permission views may eventually push us toward additional managed capabilities as adoption scales.”
Advice for Other Engineering Leaders
Asked what he’d tell another engineering leader weighing build vs. adopt, Rajesh didn’t hesitate:
“Most teams underestimate how fast authorization becomes a platform concern. If your product only needs very simple, static access rules, you can get pretty far with something lightweight. But the moment you need inheritance, delegated sharing, group membership, parent-child propagation, external collaboration, or cross-product consistency, you are no longer solving a small local problem. At that point, building and maintaining your own system is usually more expensive than it looks. My advice would be to adopt a proven model early, especially if you expect your access patterns to evolve.”
Rajesh Hariharan, Engineering Leader for Platforms, Calendly
Calendly didn’t adopt SpiceDB simply to solve authorization for one AI feature. They established a shared authorization platform that can support future AI products, collaborative workflows, and increasingly sophisticated access models across the company. What began as a Notetaker pilot is now the foundation for how Calendly plans to build secure AI experiences at scale.