We recently addressed issues affecting permissions checks in multiple Box services. We would like to take the opportunity to further explain these issues and the steps we have taken to keep them from happening in the future.

On November 23rd, 2022 between 10:39 AM and 11:29 AM, some users may have experienced difficulties while accessing content in Box. During this time, permissions checks were not available for certain workflows, which caused multiple services to stop allowing access. The issue occurred due to a non-backward-compatible change that was introduced while adding a feature intended to improve the performance of permissions checks. We were able to resolve the issue by reverting the change. In addition, we are working to improve our testing and monitoring processes to prevent similar issues from occurring in the future. 

‌

Analysis

Permissions checks depend on a schema. In order to make checks faster, we are adding support for bulk lookups, a feature that will reduce the number of requests to other internal services and thus improve the response time. Some new fields required for the bulk-lookups feature were added in a way that made the change non-backward-compatible, causing services to fail in production. This failure rendered the permissions system temporarily unable to grant access to certain content in Box.

‌

Corrective Actions

The following corrective actions have been completed or are planned:

• Add tests to ensure backwards-compatibility.
• Enhance our code-review checklist to add looking for non-backwards-compatible changes.
• Improve our deployment process to add more training for developers who publish permissions changes.

‌

We are continuously working to improve Box and want to make sure we are delivering the best product and user experience we can. We hope we have provided some clarity here and we would be happy to answer any questions you may still have regarding this matter. 

Sincerely,
The Box Team