I can’t think of a single time where my backend was literally just a crud api over entities. These toys fall apart beyond a hello world app. No validation, no authorization, no authentication, no property level permission, no events, no auditing… the list of what is actually needed for a real application goes on.
This is a proof of concept only so it sticks to a simple CRUD set of endpoints.
Some of the features that you evoke are already on the pipe (Auth, permissions ABAC/RBAC...) but obviously it will still have limitations for more complex use cases...
I am thinking about a nice hook system to add this kind of logic somewhere else like on edge functions or external APIs. The point is to keep things simple and allow more use-cases without too much trade-off. Hard choices.