Do you plan to add ABAC permission policies consisting of an expression of arbitrary attribute-based conditions for the object? Say 'o.group = 'guest' AND o.loc

Do you plan to add ABAC permission policies consisting of an expression of arbitrary attribute-based conditions for the object? Say 'o.group = 'guest' AND o.location in ['CA', 'WA']. Recently a prospective client, coming from the world of Active Directory, has expressed a need for such a feature in ASPSecurityKit. I haven't read the Zanzibar paper, but In ASPSecurityKit we've implemented ACLs on a similar concept – we call it activity-data authorization (ADA) [0]. Since it works as part of your application as a library, it can inspect request and automatically discover and authorize access to objects [1]. The attribute-based permission policies for users is something we're evaluating now. 0: https://youtu.be/u9NnBNEMpF4 https://youtu.be/u9NnBNEMpF4 1: https://aspsecuritykit.net/docs/article/how-to-perform-activity-based-data-aware-authorization/#authorizing-data https://aspsecuritykit.net/docs/article/how-to-perform-activ...