The Access Control Revamp v2

It's fascinating how the tech landscape has evolved over a short period. Remember the days when we painstakingly hard-coded app authentication, safeguarding passwords in encrypted forms? Seems archaic now. The de facto authentication approach today leans heavily on providers like Auth0, Clerk, among others. Interestingly, we seem to be following a similar trajectory with authorization. Developers are increasingly harnessing the power of tools such as OPA and Rego for crafting application policies. Just recently, AWS rolled out a fresh policy language named Cedar, specifically designed for app-level authorization. Not to mention, OSO secured a hefty $15 million in funding for their policy engine. Permit.io too has been making waves with a novel standard for frontend authorization, termed FoAz (FoAz.io). And then we have Auth0 launching their rendition of Google Zanzibar, aptly named OpenFGA. It's clear there's a general push towards retooling app authorization systems. Where do you stand in this evolution? Are you maintaining the old guard with 'if (user.admin)' style imperative code? Have you ventured into the world of open-source policy engines? Are you contemplating using one of these emerging cloud services for managing permissions? Or are you considering alternative permission models beyond RBAC? I'm eager to hear your viewpoints on this 'access control revamp v2'. What's your perspective on these changes?