I love reading posts like this because it shows that authorization isn't as niche as it once was. I also empathize with avoiding dependencies when you ship enterprise software for running on-prem; we abused Postgres a lot while serving enterprise customers for Quay before we founded AuthZed/SpiceDB.

As an engineer it's your job to decide when is the right time to use a dedicated system or continue to invest in your own. I can't help but see the similarities in their design to concepts from Zanzibar/SpiceDB, and that's great! It also means if they ever do encounter a situation where the existing system is no longer viable (engineers leave or a new design constraint requires rethinking), they _can_ migrate to a dedicated solution easily.

I think this is true of security features, and even security teams in general. Only noticed in their absence

The https://casl.js.org/v7/en/ link is dead

edit: fixed now

I thoroughly enjoyed this read. As it states at the beginning: rbac is necessary, yet not sexy. I don't use infiscal, yet this post was quite a good insight. Thanks for sharing it!