We're actively evaluating this, particular b/c: Open, dynamic acl+rbc = modern google-docs-style policies for regular webapps, postgres adapters = no change in operations (vs keycloak, orly, ..). That's been a fairly unique combo. However, we're still doing our own eval because we saw concerning issues in the gh around perf+correctness, and it's not obvious how to use it.<p>Curious on other experiences / alternatives. Ex: We're trying to keep the CMS parts of our stack especially boring, so django/postgres/casbin is surprisingly tight, while DB backing of a user's/org's custom ACL/RBAC sharing rules in say OPA seems more like a science project (despite looking like a great project when zoomed out), based on the docs (<a href="https://www.openpolicyagent.org/docs/latest/external-data/" rel="nofollow">https://www.openpolicyagent.org/docs/latest/external-data/</a>)<p>The casbin<>db integration decision was pretty wise, vs the continuing trend of policy engines bringing their own infra, and thus 'the tail wagging the dog'. I'd love to see someone figuring out RBAC/ABAC+ACLs as DB-native ~RLS, instead of having to introduce an extra moving piece of infra for every DB query, when the DB is right there!