Airbnb employs a context-based identity model, supporting privacy-first social features.

TL;DR

• Airbnb has redesigned its identity and connection model to separate internal user identities from external public profiles, allowing participation in social experiences without exposing global identity information.
• The new architecture replaces a unified global profile database with multiple context-specific profile repositories, creating isolated social graphs that prevent cross-experience identity correlation.
• Access to profile data is governed by a co-participation mechanism and Airbnb's internal authorization framework, Himeji, which applies relationship-based access control at the data layer rather than just the interface layer.
• The migration involved scanning the entire codebase using automatic audit tools and AI-assisted refactoring tools to suggest code changes, with engineers manually validating updates to ensure business logic integrity.
• This approach supports Airbnb's strategy to expand social interactions in its "Experiences" section, addressing the growing need for controlled identity disclosure among strangers.

Why It Matters

This development is significant for AI practitioners and enterprise architects because it demonstrates a practical implementation of context-aware privacy preservation at scale. It highlights how modern platforms are moving beyond static user attributes to relationship-based access control, a pattern that is increasingly critical as social features become embedded in non-social services like travel and booking. Additionally, the use of AI-assisted tools for large-scale code migration offers a blueprint for managing legacy system transformations in regulated or privacy-sensitive environments.

Key Data

• System Name: Himeji, Airbnb's internal authorization framework that applies relationship-based access control policies at runtime.
• Architectural Shift: Transition from a single unified global profile database to multiple context-specific profile repositories that are isolated from one another.
• Team Involvement: Migration required coordinated effort across engineering, product, privacy, and legal teams.
• Tooling: Usage of automatic audit tools to scan data access patterns and AI-assisted refactoring tools to propose code modifications.
• External Reference: Joy Jing (referenced via a LinkedIn blog post) noted the system is designed to support social interaction without compromising privacy.

Technical Details

• Context-Isolated Profiles: The new model replaces the global profile with scoped identities that are only visible within specific contexts (e.g., a particular activity or group). This prevents users from being linked across different experiences, effectively creating siloed social graphs.
• Relationship-Based Access Control: The system uses the Himeji framework to evaluate whether a shared context exists between users before granting access to profile information. This execution occurs at the data access layer, ensuring consistent privacy guarantees across services rather than relying solely on UI restrictions.
• Automated Migration Pipeline: Engineering teams developed automatic audit tools that scan user data access patterns to generate lists of candidate locations requiring updates. These findings are distributed to responsible teams based on codebase structure.
• AI-Assisted Refactoring: AI tools propose code modifications based on audit results. Engineers review and validate each suggestion before deployment. This human-in-the-loop workflow allows the team to scale the migration while maintaining accuracy and ensuring business logic remains intact.

Industry Insight

• Privacy as a Feature: Companies expanding into social or group-based features must treat privacy boundaries as a core architectural requirement. Airbnb’s shift suggests that "context-aware" identity disclosure is becoming the standard for platforms where strangers interact.
• Data Layer Enforcement: Relying on interface-level restrictions for privacy is insufficient. Enforcing access controls at the data layer (as done via Himeji) provides a more robust defense against cross-service data leakage and ensures consistency.
• AI-Driven Legacy Migration: The combination of static analysis/audit tools and generative AI for code suggestions, coupled with mandatory human validation, is an emerging best practice for large-scale technical debt reduction and system modernization in complex enterprise codebases.

zation framework that applies relationship-based access control policies at runtime. It evaluates user relationships and shared contexts to determine if profile data access should be granted, enforcing these rules at the data layer for consistency.

Q: How did Airbnb manage the code migration for this change?
A: The team used automatic audit tools to identify places in the codebase needing updates, distributed these findings to relevant teams, and utilized AI-assisted refactoring tools to propose code changes. Engineers then manually reviewed and validated these changes to ensure they did not impact expected functionality.