In my experience it's always the permissions system where messy real world business has to be translated in to SQL that doesn't lock up the system when some pro

In my experience it's always the permissions system where messy real world business has to be translated in to SQL that doesn't lock up the system when some program admin added to 200 teams tries to load the index page. "What can this user see" has always been a very complex question in every crud app I've worked on.