> When you have RBAC based on multiple different conditions, e.g. "does user have XYZ?" you will have to architect your entire app around putting these claims into JWT so the GraphQL engine can properly map those onto RLS.

If it's RBAC, why am I not just giving creating per-user postgres roles inheriting from appropriate roles for the relevant features?

> In a traditional app auth is on the app level and defined in code, not a mix of code, SQL, JWT claims and Hasura/Supabase configs.

Doing authz via DB-side permissions attached to per user DB accounts is an equally, and more well-established, traditional app approach.