Looking for feedback on a developer-focused service product

https://auth0.com - They've been at it for some time now but have never used them.

Used in the past a simple one table solution:

who_id, what_id, canCreate, canRead, canUpdate, canDelete

• works very well with uuid (need to add a model field otherwise)
• can update it with a weight where each role (identified by a who_id) has a different value and now you have hierarchy
• can add more boolean flags if the basic CRUD don't suffice

I might do 2-3 perm checks / request in order to know if a user is allowed to do something. Ex: A user with Role X can create Comments but can he create Comments on Project he's not part of.

For the most part I've gotten away with User/Guest roles and maybe some special Owner permissions. My gut is that's the majority of use cases.

Right now at Mutant I'm thinking about implementing linux style permissions with owner, group and other. Set a perm for each row and query directly on the item to get all "Products" that I can view - this way I'm looking at the real state of an item, not inferring from Role or having it mapped in another place. It feels like perm info should be part of item's fabric if that make sense.

To your concern, I don't know if I would use an outside service for this but I might not be in the target. I would use for prototyping and getting things out faster but on the other hand, am I prototyping if im thinking about permissions?

It's clear that it is still "pain" to do and it can go wrong if not done with care and testing. Maybe there's a place in a Firebase stack or the beginning of a new Serverless platform that ticks off some of these "common" problems that we keep re implementing all the time (in the same way).

Hope this is helpful in some way, best of luck!