spicedb

For SpiceDB[0], we've found a lot of success using this framework to define our own analyzers; it's probably 10x easier now with LLMs. No need for tribal knowledge or more time wasted on code review if you can just turn it into a linter and move on. [0]: https://github.com/authzed/spicedb/tree/main/tools/analyzers

The main pain points around using a Zanzibar-like approach (typically called Relationship-based access control) are: (1) The need to write relationships and keep them updated in the permissions database. Often, this requires writing to both the application database and the permissions database, at the same time. On the SpiceDB side, we provide a Postgres FDW [1] to make this easy IF your application data lives in Postgres (2) Representing complex permissions in ReBAC schema can be a challenge (at first) if you're coming from an ABAC system - you need a slightly different mental model for ReBAC, where (as its name implies), permissions are reachable via the relationships between objects, rather than attributes on objects. (3) ACL-aware searching: this is a very hard problem in authz in general and gets slightly harder with ReBAC. The separ