Jake Moshenko and the trouble with a simple permission

The first customer request was perfectly reasonable. Jake Moshenko and his co-founder had built Quay, a place for developers to keep private Docker container images. Individual people could own repositories. Then someone wanted an organization to own one. A modest request, the sort a growing software company ought to welcome. It sent the founders back into their permissions code.

After organizations came groups. After groups came teams, and then teams inside other teams. Customers had an unfortunate habit of arriving with actual organizations, complete with hierarchies. The software had to catch up. Moshenko recalls that some features never shipped because the authorization model could not accommodate them. A product intended to help developers move faster had acquired its own internal speed limit.

That experience sits behind AuthZed, the company he co-founded with Joey Schorr and Jimmy Zelinskie in 2020. Moshenko is its CEO. Its central proposition is straightforward: engineers should be able to buy or adopt a permissions system that keeps working as their applications become more complicated. He had already spent years discovering how much trouble the alternative could cause.

A career that took a useful wrong turn

Moshenko studied computer engineering at the University of Michigan, then worked at Boeing, Amazon and Google. His early engineering jobs ranged from real-time software to the systems of large internet businesses. By 2012 he and Schorr, whom he met at Google, had left to build DevTable, an online development environment.

The original idea did not take off. Something they built along the way did: Quay, an early private Docker registry. Containers gave developers a way to package software; those packages still needed somewhere to live. Private storage was a practical need, and Moshenko and Schorr built around it. Their infrastructure career emerged from work that had begun with a different product in mind.

CoreOS acquired Quay in 2014. Moshenko became its New York site lead, and the work expanded into the machinery of deploying and running software. CoreOS was trying to make infrastructure associated with Google available to other organizations. Quay became part of that effort. Red Hat acquired CoreOS in 2018, and IBM subsequently acquired Red Hat.

The sequence gave Moshenko a view of software from several organizational altitudes: the founders building a product, a growing infrastructure startup, and an established enterprise supplier. It also kept him working with people who would become his next co-founders. Zelinskie joined the Quay team at CoreOS. AuthZed's founding partnership grew out of work they had already done together.

The share button has a complicated life

Permissions can look like a small feature until someone tries to change them. A document belongs to a project. A project belongs to a team. A person joins that team, leaves it, or receives a direct invitation. Each action changes who may read or edit something. The button is small. The social arrangement behind it can be considerable.

At Quay, roles, users and teams lived in the main database. Checking access meant joining through those tables, again and again. The cost appeared in database capacity as well as engineering effort. The experience repeated at CoreOS, where the team wanted flexible authorization for its Kubernetes-based platform, Tectonic. Moshenko had encountered the same underlying need in another setting.

In 2019 Google published its Zanzibar paper, describing a shared authorization system used across its products. Moshenko saw a way forward. He and his colleagues formed AuthZed the following year to commercialize those ideas. The company joined Y Combinator's winter 2021 batch; SpiceDB, its permissions database, became open source later in 2021.

Moshenko has also annotated the Zanzibar paper for readers outside Google. It is a fitting piece of work for someone whose companies repeatedly translate large-scale infrastructure ideas into tools other developers can use. The annotations invite people into the technical reasoning. Understanding the design gives a developer something more substantial than a promise on a sales page.

Selling something people replace reluctantly

A permissions company has an awkward commercial assignment. Its prospective customers already have permissions. Those systems may be expensive to maintain or inconvenient to change, but replacing security-sensitive infrastructure takes deliberation. A founder can explain the benefits beautifully and still arrive six months before anyone has a reason to listen.

Moshenko describes a narrow buying window: a feature requirement or a scaling problem prompts a team to reconsider its approach. AuthZed needs to be familiar by then. That helps explain his investment in writing, talks and community conversations. Much of the work happens before a customer is shopping. Patience becomes part of the job description.

“There is no shortcut for being authentic, helpful”

Jake Moshenko, on building developer community

His advice to enterprise founders also gives customer relationships a human scale. A company that adopts infrastructure often brings an internal champion into the relationship. That person can explain what users need and help the supplier understand the organization. The sale begins an extended collaboration. Technical understanding and attention to people have to survive the purchase order.

In June 2024 AuthZed announced a $12 million Series A led by General Catalyst, bringing its disclosed funding at that point to $15.9 million. Moshenko explained a preference for growing largely from revenue and using venture money to accelerate work that was already succeeding. The amount raised was a means of financing the company he wanted to build.

The CEO gets his keyboard back

Running AuthZed put more of Moshenko's time into operating the business. In July 2025 he described returning to hands-on development with an AI coding tool. He needed a demo involving several applications, different programming languages and shared permissions. Pulling engineers away from product work seemed costly; finding a contractor would take time. He decided to try building it himself with Claude Code.

The experiment had an appropriately untidy beginning. His instructions became too broad, the output deteriorated, and insufficient use of source control cost him work. He adjusted his process: smaller tasks, precise instructions and commits at useful stopping points. Eventually the demo connected three applications through SpiceDB. The manager had acquired another worker, along with another reason to write a clear brief.

The public repository makes the result tangible: email, documents and groups, sharing authorization across applications. That is an unusually personal demonstration of his company's argument. Moshenko used a new development tool to build a working example of the permissions infrastructure he sells. His renewed pleasure in making software arrived alongside a practical concern about what increasingly capable software should be allowed to do.

The next user might be an agent

By 2026 Moshenko was arguing that AI agents would put additional pressure on authorization. In a February essay, he challenged the use of policy engines for dynamic, relationship-heavy agent environments. His argument centers on changing context: access depends on relationships and available data, and collecting that context is itself part of the work.

AuthZed's product direction has followed that concern. In April the team introduced SpiceBox and spicedb-dev: one to enforce permissions on coding agents, the other to help agents generate applications with appropriate authorization. These are team projects, and their authors include Schorr and Sam Kim. The division of labor matters in a founder story; a CEO's evolving thesis becomes useful through other people's engineering.

In September 2026 Materialize reached general availability for AuthZed Dedicated. It precomputes selected expensive permissions relationships, keeping results updated as relationships change. The technical problem has a familiar shape. More users, more organizational connections and more automated activity produce more work for the access system. Moshenko's old complaint about permissions consuming database capacity has acquired a new generation of customers.

A microphone, and the same old question

Moshenko now hosts Base Layer, a podcast about AI infrastructure. Guests have included Datum's Zac Smith, Kilo Code's Emilie Schario and former Google Zanzibar leader Ari Shamash. In the October 2026 conversation with Shamash, the technical history leads into adoption: how do you persuade people to change infrastructure when they already have plenty of other work?

The answer returns to customers. Shamash describes finding teams with a problem, speaking their language and building integrations with them. Moshenko recognizes the unglamorous labor involved. The conversation gives his career a pleasing circularity: someone who turned Google's published ideas into a company can sit with a leader behind that work and compare the difficulty of getting people to use it.

There is room for curiosity outside a product roadmap. On LinkedIn, Moshenko has recommended qntm's short story MMAcevedo, admiring its Wikipedia-like form and its questions about synthetic consciousness and ownership. His public conversations move between engineering details and the consequences of machines doing more on our behalf. The questions can become philosophical surprisingly quickly for a business concerned with access checks.

Yet the customer request at the beginning remains a useful guide. Someone wanted an organization to own a repository. The next person wanted a team. Now software itself is becoming a more active participant. Moshenko has built a company around making those arrangements manageable. Progress brings more things that can act, more things worth sharing, and more reasons to ask who has permission.