Infisical rebuilt folder-level access without migrating to Zanzibar
There is no 10x RBAC
Infisical added folder-based RBAC to let users grant or deny access to single folders, solving cases where a role doesn't match a person's actual access needs. Rather than adopt a Zanzibar-style system like SpiceDB or OpenFGA, which would force every self-hosted customer to run another stateful service and introduce breaking changes, they standardized five permission tiers and layered deny-then-allow rules so folder grants always win. They also fixed cache invalidation with a per-project version counter.
There's no 10x RBAC system people rave about on Twitter. Access controls are a box a product checks, but not a killer feature.
- sandeepkd
From what I have seen this subject needs a lot more attention than what it receives which translates in the reality that in almost majority of the places the access rules are pretty open from inside. This is one area where centralization (using some solution like AuthZed) and decentralization (skipping the checks based on business domain locally) present this healthy tension which requires some one who has expertise on the business domain to make it work efficiently
- jzelinskie
I love reading posts like this because it shows that authorization isn't as niche as it once was. I also empathize with avoiding dependencies when you ship enterprise software for running on-prem; we abused Postgres a lot while serving enterprise customers for Quay before we founded AuthZed/SpiceDB. As an engineer it's your job to decide when is the right time to use a dedicated system or continue to invest in your own.
I can't help but see the similarities in their design to concepts from Zanzibar/SpiceDB, and that's great! It also means if they ever do encounter a situation where the existing system is no longer viable (engineers leave or a new design constraint requires rethinking), they _can_ migrate to a dedicated solution easily.
One trade-off I didn't see acknowledged in this post is the sacrifice in terms of tooling. Dedicated solutions have toolchains for debugging and proving correctness that you can integrate into CI/CD and homegrown solutions can't typically spare the time to also build themselves a nice toolchain.
- bbkane
Maybe it's because I'm not an RBAC expert, but I had a hard time understanding the data model for folders. Are they a subject? And then there's a layered CASL where layers overwrite each other? And the user is an actor?