Relationship-based Access Control / FGA / Zanzibar

[StevenLangbroek]

Hey folks! We're just getting started with Supabase, and I was wondering if there's any appetite around fine-grained or relationship-based authorization, as first described by Google in their Zanzibar paper. I've seen a few implementations in the wild:

• Oso
• OpenFGA
• Keto

Would love to discuss :)

[adriangalilea]

Hey, I'm super interested in this.

I figured supabase is not the way to implement ReBAC perhaps, or at least not for now. But I'm intrigued ;)

As far as I've seen Keto has some implementation with supabase, but not sure how well they play together with what supabase already does in terms of auth/authz.

[mrkwtz]

I'd say doing something like with the Auth Hooks, where you instead hook into the authorization, define an endpoint for external authz check and return with 200 / 403.

[abeaclark]

Would LOVE an openFGA implementation. It supports postgres as a storage option already. A first-class integration into RLS would take supabase to the next level in terms of building enterprise grade applications.

[benschac]

I too would love this.