When you're building a serverless framework with the goal of direct client access to managed infrastructure without writing server side code, rules languages li

When you're building a serverless framework with the goal of direct client access to managed infrastructure without writing server side code, rules languages like this are an awesome tool to have. You need to: authenticate users, authorize their actions, validate schema, ensure referential integrity, and perform business logic checks. Most (if not all) BaaS platforms have something like this: - Firebase: Database Rules (https://firebase.google.com/docs/database/security/ https://firebase.google.com/docs/database/security/), Storage Rules (https://firebase.google.com/docs/storage/security/ https://firebase.google.com/docs/storage/security/) - Parse: Roles and ACLs (https://parseplatform.github.io//docs/js/guide/#roles https://parseplatform.github.io//docs/js/guide/#roles) - Horizon: http://horizon.io/docs/permissions/ http://horizon.io/docs/permissions/ - Couchbase Mobile: http://developer.couchbase.com/documentation/mobile/1.3/develop/guides/sync-gateway/authorizing-users/index.html http://developer.couchbase.com/documentation/mobile/1.3/deve... - Deepstream: https://deepstream.io/docs/server/valve-permissions/ https://deepstream.io/docs/server/valve-permissions/ When used for AuthN/Z, most seem to align with Role Based Access Control (RBAC), while others go for Attribute Based Access Control (ABAC). The former is generally easier to reason about and build, while the latter is more powerful though harder to build and explain. Most IaaS IAM systems (like those in AWS [http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_po...], GCP [https://cloud.google.com/compute/docs/access/iam] https://cloud.google.com/compute/docs/access/iam]) are RBAC, while BaaS solutions seem to trend to ABAC for schema validation + business logic. Kubernetes also has a cool way of doing this: http://kubernetes.io/docs/admin/authorization/ http://kubernetes.io/docs/admin/authorization/ Disclosure: I work on this at Firebase