What would a "permissions-first ORM" look like? Looking for spec feedback
typescript-superapp.bunnytech.app
What would a "permissions-first ORM" look like? Looking for spec feedback
1–8 of 8 posts
Re: What would a "permissions-first ORM" look like? Looking for spec feedback
#2[dead]
Re: What would a "permissions-first ORM" look like? Looking for spec feedback
#3[dead]
The idea behind this spec is to give users full access to their own data. For example, ORM-backed data could be consumed by an MCP server, an autonomous agent, or a vibe-coded app. The goal is to make the data layer flexible and interoperable so that any client can build on top of it.
Looking ahead, I believe the best product managers will be the end users themselves. They'll want to vibe-code their own frontends and connect them to a secure backend.
That raises a key question: how do we design a backend that's secure, safe, and robust enough to support a wide range of use cases while still being extensible enough for user-driven customization?
Re: What would a "permissions-first ORM" look like? Looking for spec feedback
#4I haven't read through the entire thing yet, but looks conceptually similar to Zenstack (https://zenstack.dev) with the auth plugin and auto-generated APIs, so I'd be interested in a comparison with that.
Fwiw, I went down the path of trying to do something similar with Drizzle and gave up since it was in such a state of flux (this was last year). There are (were) a ton of edge cases around trying to add automatic filters to queries to the point that it was hard to justify not just rolling my own ORM.
Re: What would a "permissions-first ORM" look like? Looking for spec feedback
#5[dead]
The idea behind this spec is to give users full access to their own data. For example, ORM-backed data could be consumed by an MCP server, an autonomous agent, or a vibe-coded app. The goal is to make the data layer flexible and interoperable so that any client can build on top of it. Looking ahead, I believe the best product managers will be the end users themselves. They'll want to vibe-code their own frontends and…
This closely aligns with what I expect ZenStack could help in the AI era, which you could tell from the two demos I created :
-[MCP](https://zenstack.dev/blog/database-to-mcp)
-[Agent](https://zenstack.dev/blog/ai-agen)
From my experience, a declarative and flexible AuthZ layer is the cornerstone of everything.
Re: What would a "permissions-first ORM" look like? Looking for spec feedback
#6Check out Zanzibar / SpiceDB / ReBAC and "Macaroon Auth" (disambiguating search phrase) for what modern permission systems can be
Re: What would a "permissions-first ORM" look like? Looking for spec feedback
#7Earlier quoted context omitted.
The idea behind this spec is to give users full access to their own data. For example, ORM-backed data could be consumed by an MCP server, an autonomous agent, or a vibe-coded app. The goal is to make the data layer flexible and interoperable so that any client can build on top of it. Looking ahead, I believe the best product managers will be the end users themselves. They'll want to vibe-code their own frontends and…
This closely aligns with what I expect ZenStack could help in the AI era, which you could tell from the two demos I created : -[MCP]( https://zenstack.dev/blog/database-to-mcp ) -[Agent]( https://zenstack.dev/blog/ai-agen ) From my experience, a declarative and flexible AuthZ layer is the cornerstone of everything.
There are a few differences between ZenStack and the proposed specs — see this comparison: https://claude-zenstack-comparison-page-8lwqi-superapp-docs....
Re: What would a "permissions-first ORM" look like? Looking for spec feedback
#8Earlier quoted context omitted.
This closely aligns with what I expect ZenStack could help in the AI era, which you could tell from the two demos I created : -[MCP]( https://zenstack.dev/blog/database-to-mcp ) -[Agent]( https://zenstack.dev/blog/ai-agen ) From my experience, a declarative and flexible AuthZ layer is the cornerstone of everything.
There are a few differences between ZenStack and the proposed specs — see this comparison: https://claude-zenstack-comparison-page-8lwqi-superapp-docs....
That's really a honest and thoroughly comparsion, thanks for sharing!
To be clear, what I mean is the goal that it could be consumed by an MCP server, an autonomous agent, or a vibe-coded app are the same.