I should have mentioned this, Ent has built in authorization at the row level: https://entgo.io/docs/privacy https://entgo.io/docs/privacy There are some gotch

I should have mentioned this, Ent has built in authorization at the row level: https://entgo.io/docs/privacy https://entgo.io/docs/privacy There are some gotchas with this, but like all auth you need to take the time to think through it and once you do it is extremely powerful. This approach means you can essentially forget about needing to scope queries to specific users throughout your codebase as Ent will automatically apply that part of the query wherever it is needed. I know there's been some comments on this thread and others about coupling auth to your ORM, I think it's necessary as it's otherwise too easy to forget this somewhere deep in your code and accidentally expose everything to the wrong user.