Developer Ditches ReBAC Tools Over List-Filtering Limitations, Moves Auth to Postgres

A developer tested relationship-based access control (ReBAC) by integrating OpenFGA into a prototype, running 120 assertions across 16 test scenarios before ultimately removing it. The core issue was not with ReBAC as a model but with how existing tools handle list queries — determining which objects a user can access, not just whether they can access a specific one. Approaches like post-query filtering, fetching full permission lists, or maintaining a local index each introduced problems around pagination accuracy, performance, or data synchronization. Permit.io's partial policy evaluation was identified as the conceptually correct solution, but its Postgres support remains in early access and is limited to attribute-based rather than relationship-based policies. The developer resolved the problem by moving authorization logic directly into Postgres as native functions, enabling permission checks and list filtering to run in the same transaction without a separate sync layer.