The database speaks a binary database protocol. The Gateway speaks websocket and http. Access control is managed via channels, and you configure the gateway wi

The database speaks a binary database protocol. The Gateway speaks websocket and http. Access control is managed via channels, and you configure the gateway with a JS function that determines which channels a document belongs to, so you don't ACL annotations, the ACL is determined dynamically by your code at write time. There's a tiny bit of write amplification as we persist channel membership in an index, but that's to avoid massive read amplification of irrelevant records when clients sync their subset of channels.