Suggestions
Graham Neray
Cofounder & CEO at Oso
Graham Neray is the Cofounder and CEO of Oso, a company specializing in authorization as a service for developers.12 He co-founded Oso in 2018, which offers a platform to help businesses build secure microservices applications.5
Prior to founding Oso, Neray worked at MongoDB for about six years, where he held various positions including Chief of Staff to the CEO.6 He graduated from Brown University with a B.A. in Political Science.4
Neray is known for his customer-centric approach, often joining customer calls and interviews personally. He emphasizes the importance of listening to customers and building products based on their needs.1 Under his leadership, Oso has raised nearly $26 million in funding and has grown to serve thousands of companies.35
In addition to his role at Oso, Neray has been involved in mentoring activities with organizations like Techstars and iMentor.6 He is passionate about creating value for customers and aspires to build Oso into a recognized and respected brand in the authorization space.4
Highlights
This tweet got way more play than I expected
As someone who has spent the last 7 years working on permissions, I agree that RLS is not great what i respect about it is that it's an explicit, opinionated approach.
"it's easy" is flat out wrong. in the simple case, yes, but i've met 2k eng teams, and any app of scale in b2b has permissions complexity with mulitple engineers working on it
and saying "just do it in the server" says nothing about best practices, which are important once you learn that there is complexity. here are some best practices i've found while working on this problem:
- centralize authz logic in one place (eg share library); don't intermingle with biz logic
- you can use middleware for route-level authz, but generally you should put the authz logic as close to the db as possible. multiple reasons for this, but one is performance, specifically for filtering lists of authorized resources
- hierarchies are rly common, eg user hierarchies, file/folder structures. if you expect to need it, think a touch in advance
- leave your hubris at home

