<story><title>Aserto: Developer API for permissions and RBAC</title><url>https://www.aserto.com/blog/aserto-the-developer-api-for-permissions-and-rbac-is-open-to-all</url></story><parent_chain></parent_chain><comment><author>fabian2k</author><text>This is probably a pretty stupid question, or at least based on some misconception of mine about this space. But I don&amp;#x27;t really understand how permissions as a service or API can work efficiently.&lt;p&gt;If I request a single resource, of course this can work if I ask a second API on whether the request is allowed or not. But if I query a database for a list of items, to add access control I need to modify the database query. I can&amp;#x27;t just filter after the fact, it&amp;#x27;s too easy to cause pathological performance issues there e.g. if the user has only access to a very small subset of a large list of results. How does this work with a separate access control API that can&amp;#x27;t directly modify the database query?</text></comment>
<story><title>Aserto: Developer API for permissions and RBAC</title><url>https://www.aserto.com/blog/aserto-the-developer-api-for-permissions-and-rbac-is-open-to-all</url></story><parent_chain></parent_chain><comment><author>eatonphil</author><text>There are a lot of new-ish products in the last 5 years in the auth&amp;#x2F;identity space. I have been meaning to dig into them: Kanadm, Keycloak, Ory, SuperTokens, Oso, FusionAuth, CAS, maybe Authzed. I hadn&amp;#x27;t heard of Aserto yet, adding them to the list. Although I&amp;#x27;m most interested in OSS products and Aserto looks like it is hosted-only.&lt;p&gt;If anyone has already done an independent study of the ecosystem I&amp;#x27;d love a link.</text></comment>