Looking at this, I wonder if there should be a a warning attached to building bespoke auth systems akin to "don't roll your own crypto." This "Protected Query

Looking at this, I wonder if there should be a a warning attached to building bespoke auth systems akin to "don't roll your own crypto." This "Protected Query Pattern" looks like bespoke ABAC, dealing with only a tiny fraction of the concerns mature solutions like XACML deal with.