What would a "permissions-first ORM" look like? Looking for spec feedback

Re:What would a "permissions-first ORM" look like? Looking f... by umairnadeem123 on Monday February 16, 2026 @08:31PM (#47042592)

Interesting idea. The “permissions-first” bit feels like it wants to be capability-based: you don’t get a raw model/table handle, you get a scoped handle whose type encodes (read|write|delete) + row/domain constraints.

Two pitfalls I’d watch: 1) Don’t pretend you can out-ORM the DB: ultimately enforce in the database (RLS/GRANTs/policies), and treat ORM permissions as a compile-time/ergonomic layer. 2) Make privilege boundaries explicit at function boundaries (who creates the scoped handle?) so you don’t end up with ambient auth context leaking everywhere.

If you can generate SQL that is provably policy-complete (or at least auditable), that’s a big win.

[ Parent | on HN ]

Re:What would a "permissions-first ORM" look like? Looking f... by iosifnicolae2 on Monday February 16, 2026 @08:44PM (#47042683)

The idea behind this spec is to give users full access to their own data. For example, ORM-backed data could be consumed by an MCP server, an autonomous agent, or a vibe-coded app. The goal is to make the data layer flexible and interoperable so that any client can build on top of it. Looking ahead, I believe the best product managers will be the end users themselves. They'll want to vibe-code their own frontends and connect them to a secure backend.

That raises a key question: how do we design a backend that's secure, safe, and robust enough to support a wide range of use cases while still being extensible enough for user-driven customization?

[ Parent | on HN ]

Re:What would a "permissions-first ORM" look like? Looking f... by carlual on Monday February 16, 2026 @09:53PM (#47043162)

This closely aligns with what I expect ZenStack could help in the AI era, which you could tell from the two demos I created :

-[MCP](https://zenstack.dev/blog/database-to-mcp)

-[Agent](https://zenstack.dev/blog/ai-agen)

From my experience, a declarative and flexible AuthZ layer is the cornerstone of everything.

[ Parent | on HN ]

Re:What would a "permissions-first ORM" look like? Looking f... by iosifnicolae2 on Tuesday February 17, 2026 @05:43AM (#47045915)

There are a few differences between ZenStack and the proposed specs — see this comparison: https://claude-zenstack-comparison-page-8lwqi-superapp-docs....

[ Parent | on HN ]

Re:What would a "permissions-first ORM" look like? Looking f... by carlual on Wednesday February 18, 2026 @12:12AM (#47057421)

That's really a honest and thoroughly comparsion, thanks for sharing!

To be clear, what I mean is the goal that it could be consumed by an MCP server, an autonomous agent, or a vibe-coded app are the same.

[ Parent | on HN ]