4 ms·

What would a "permissions-first ORM" look like? Looking for spec feedback

2 points by iosifnicolae2 8mo ago

umairnadeem123 8mo ago
[dead]
- iosifnicolae2 8mo ago
  The idea behind this spec is to give users full access to their own data. For example, ORM-backed data could be consumed by an MCP server, an autonomous agent, or a vibe-coded app. The goal is to make the data layer flexible and interoperable so that any client can build on top of it. Looking ahead, I believe the best product managers will be the end users themselves. They'll want to vibe-code their own frontends and connect them to a secure backend. That raises a key question: how do we design a backend that's secure, safe, and robust enough to support a wide range of use cases while still being extensible enough for user-driven customization?
  - carlual 8mo ago
    This closely aligns with what I expect ZenStack could help in the AI era, which you could tell from the two demos I created : -[MCP](https://zenstack.dev/blog/database-to-mcp https://zenstack.dev/blog/database-to-mcp) -[Agent](https://zenstack.dev/blog/ai-agen https://zenstack.dev/blog/ai-agen) From my experience, a declarative and flexible AuthZ layer is the cornerstone of everything.
    - iosifnicolae2 8mo ago
      There are a few differences between ZenStack and the proposed specs — see this comparison: https://claude-zenstack-comparison-page-8lwqi-superapp-docs.bringes.workers.dev/docs/comparisons/zenstack https://claude-zenstack-comparison-page-8lwqi-superapp-docs....
      - carlual 8mo ago
        That's really a honest and thoroughly comparsion, thanks for sharing! To be clear, what I mean is the goal that it could be consumed by an MCP server, an autonomous agent, or a vibe-coded app are the same.
ilkhan4 8mo ago
I haven't read through the entire thing yet, but looks conceptually similar to Zenstack (https://zenstack.dev https://zenstack.dev) with the auth plugin and auto-generated APIs, so I'd be interested in a comparison with that. Fwiw, I went down the path of trying to do something similar with Drizzle and gave up since it was in such a state of flux (this was last year). There are (were) a ton of edge cases around trying to add automatic filters to queries to the point that it was hard to justify not just rolling my own ORM.
verdverm 8mo ago
Check out Zanzibar / SpiceDB / ReBAC and "Macaroon Auth" (disambiguating search phrase) for what modern permission systems can be

2 points by iosifnicolae2 8mo ago

umairnadeem123 8mo ago

[dead]

iosifnicolae2 8mo ago
The idea behind this spec is to give users full access to their own data. For example, ORM-backed data could be consumed by an MCP server, an autonomous agent, or a vibe-coded app. The goal is to make the data layer flexible and interoperable so that any client can build on top of it. Looking ahead, I believe the best product managers will be the end users themselves. They'll want to vibe-code their own frontends and connect them to a secure backend. That raises a key question: how do we design a backend that's secure, safe, and robust enough to support a wide range of use cases while still being extensible enough for user-driven customization?
- carlual 8mo ago
  This closely aligns with what I expect ZenStack could help in the AI era, which you could tell from the two demos I created : -[MCP](https://zenstack.dev/blog/database-to-mcp https://zenstack.dev/blog/database-to-mcp) -[Agent](https://zenstack.dev/blog/ai-agen https://zenstack.dev/blog/ai-agen) From my experience, a declarative and flexible AuthZ layer is the cornerstone of everything.
  - iosifnicolae2 8mo ago
    There are a few differences between ZenStack and the proposed specs — see this comparison: https://claude-zenstack-comparison-page-8lwqi-superapp-docs.bringes.workers.dev/docs/comparisons/zenstack https://claude-zenstack-comparison-page-8lwqi-superapp-docs....
    - carlual 8mo ago
      That's really a honest and thoroughly comparsion, thanks for sharing! To be clear, what I mean is the goal that it could be consumed by an MCP server, an autonomous agent, or a vibe-coded app are the same.

ilkhan4 8mo ago

I haven't read through the entire thing yet, but looks conceptually similar to Zenstack (https://zenstack.dev https://zenstack.dev) with the auth plugin and auto-generated APIs, so I'd be interested in a comparison with that. Fwiw, I went down the path of trying to do something similar with Drizzle and gave up since it was in such a state of flux (this was last year). There are (were) a ton of edge cases around trying to add automatic filters to queries to the point that it was hard to justify not just rolling my own ORM.

verdverm 8mo ago

Check out Zanzibar / SpiceDB / ReBAC and "Macaroon Auth" (disambiguating search phrase) for what modern permission systems can be