Love seeing the visuals here :) We work on scaling graph UIs, and I've been noticing the auth use case more and more! The discussion on Flattening is super imp

Love seeing the visuals here :) We work on scaling graph UIs, and I've been noticing the auth use case more and more! The discussion on Flattening is super important, though for most teams, I'd also add this dances around the costs of an extra piece of intertwined DB infra. For our internals, we ended up having to reject OPA and friends, including what Zanzibar does, because we decided our customers wouldn't want us to spend our infra innovation tokens on an extra DB and figuring out how it should intertwine on the hotpath for queries to the main DBs. For bigger/heavier sites like Carta (with especially complex rules) and especially high-traffic ones like Google, as hinted by the percentile charts, I can see their decision making way more sense. For most consumer & b2b sites though, I'm not as convinced, and especially long-term. We ended up going with Casbin as it can do ARBAC policies + reuses our SQL DB. So it's more like adding a lib than infra, even though it does come with policy features like an analysis-friendly DSL. Likewise, that means we get a few ways to tune bulk queries: most are automatically fast by smart default roles & logic, some via special-cased app-level opts (so out-of-DB), and if we ever need to, we can always do optimized in-DB queries. The options for policy engines for b2b apps is surprisingly slim. The whole experience has made me think that a SQL DB with a strong multitenant+arbac RLS story for Django/Rails/etc. users and a cloud autoscale-to-zero capability will make a killing for b2b SaaS's. Amazon Aurora and friends are close, but feels like it's still another couple years in practice.