Most authorization systems are bottlenecks disguised as security layers.

You make a request. The system thinks. 200 milliseconds pass. Your user waits. Your server burns cycles. At scale, those milliseconds add up to frustrated users and wasted infrastructure spend.

I spent years building compliance and authorization systems in enterprise environments. I worked extensively with Microsoft Graph, Purview, and compliance frameworks. I saw the same pattern everywhere: companies accepted slow authorization as inevitable.

But it’s not.

I built Metis to prove authorization doesn’t have to be a trade-off between speed and security. We deliver authorization decisions as fast as in 7 milliseconds — about 30 times faster than industry standard.

Here’s how we did it, and why our approach to AI is completely different.

The False Choice: Speed vs Intelligence

Traditional authorization gives you two bad options:

Option 1: Basic rules (fast but dumb)

  • Hardcoded if/then logic
  • No context awareness
  • Breaks when requirements change
  • Fast, but fragile

Option 2: Real-time AI (smart but slow)

  • LLM evaluates every request
  • Rich context understanding
  • Flexible policies
  • Slow — often 500ms+ per decision

Most companies pick Option 1 and call it “good enough.” The performance-conscious ones optimize down to maybe 50–100ms if they’re really good.

We asked: why choose at all?

The Insight: Think Once, Execute Forever

Here’s the contrarian approach we took:

Use AI to generate policies. Use optimized engines to execute them.

AI is incredible at understanding complex requirements and generating logic. But it’s terrible at real-time execution speed.

So we let the AI do what it’s good at — once. Then we compile the result into something that runs in microseconds.

The workflow:

  1. Describe your policy in plain English: “Users can access documents in sites where they’re members”
  2. AI generates optimized policy logic, sample requests, validation tests
  3. Policy gets compiled into fast execution paths
  4. Every request gets decided in ~7ms

Think once deeply. Execute swiftly always.

The Architecture: Built for Speed AND Security

When I was working with Microsoft Graph and Purview, I saw how enterprise tools handle authorization at scale. They poll for changes. They batch operations. They accept latency as the cost of compliance.

I wanted something different.

Connectors pull data from any REST API. Microsoft Graph, your database, your internal APIs — anything. They’re declarative and reusable.

Agents combine connectors with AI policy generation. You define what data you need. The AI understands your structure and generates the right logic.

Execution happens through optimized engines with a 99% cache hit rate. Most decisions never hit the network. The ones that do resolve in under 30ms.

The result: 6.69ms average response time with full audit trails. And consistent sub 60ms average response time under stress test environment.

What This Looks Like in Practice

Let me walk you through the demo above:

Authentication — We support OpenID Connect with Azure AD out of the box. Enterprise SSO in minutes.

Connectors — Pull user data and group memberships from Microsoft Graph. Define once, reuse everywhere.

AI Policy Generation — Describe your requirements in natural language. Get back executable policy logic with sample requests and tests.

Performance — Watch the speed. 400 requests per second without optimization. Every decision in milliseconds.

Compliance — Complete audit trails. Every request, every decision, every policy change. Logged and timestamped for any security review.

Why This Matters

Authorization latency compounds.

If every API call in your app adds 200ms for an auth check, and your average page load makes 10 backend requests, that’s 2 full seconds of authorization overhead.

Your users don’t see “authorization.” They see “slow app.”

Your infrastructure team doesn’t see “security.” They see “scaling costs.”

At 7ms per decision, authorization becomes invisible — which is exactly what it should be.

The Compliance Piece

Here’s what I learned building compliance systems: speed means nothing if you can’t prove what happened.

That’s why Metis logs everything:

  • Every authorization request
  • Every policy decision
  • Every policy change
  • All timestamped, immutable, audit-ready

When your compliance team asks “who had access to what on Tuesday at 2pm,” you have the answer.

Fast doesn’t mean loose. It means efficient.

What We’re Building Toward

Right now, Metis handles authorization brilliantly. But I see where this goes.

Most enterprise tools are built around polling: check for changes every 5 minutes, every hour, every day. It works, but it’s slow and inefficient.

I want to move the industry from polling to subscribing. Real-time change detection. Event-driven authorization. Instant policy updates.

I’ve seen how Microsoft Graph works under the hood. I know how tools like AvePoint scan for sensitive information types. They use search to identify files, Graph calls to scan users and sites, then underlying files.

It’s clever, but it’s still batch-oriented.

I want to make authorization truly real-time. Not “eventually consistent real-time.” Actually real-time.

That’s the next phase.

Why I’m Sharing This

I’m not trying to gatekeep the architecture. The philosophy matters more than the implementation details.

The core insight is simple: Don’t use AI where speed matters. Use AI where thinking matters.

Generate policies with AI. Execute them with optimized engines.

You get the intelligence of AI and the speed of compiled logic.

If you’re building authorization systems, you don’t need to copy our stack. You just need to stop accepting the false choice between speed and intelligence.

They’re not mutually exclusive.

Try It Yourself

Metis is in beta with select design partners right now.

If you’re building products where authorization performance matters — where every millisecond counts — I’d love to hear about your challenges.

You can learn more at policy.hermesc.gr or reach out directly.

And if you’re working on similar problems, especially around real-time authorization or event-driven compliance, let’s talk. I’m always looking for people pushing the boundaries of what these systems can do.

Bottom line: Authorization in 6.69 milliseconds. Enterprise compliance. Zero compromise.

It’s possible. We built it. And it’s just the beginning.

Hermès is building Metis, a high-performance Policy Decision Point for modern applications. Previously, he worked extensively with Microsoft Graph, Purview, and enterprise compliance systems, finding innovative ways to enforce security at scale.