gneray

+1

Oy vey: https://x.com/theo/status/2045862972342313374?s=46

This is cool! How, if at all, are you thinking about sequences of permissions in a given session? Like, ratcheting down the permissions, e.g., after reading a secret?

Everyone here firing shots at this guy should try holding their tongues.

You/we are all susceptible to this sort of thing, and I call BS on anyone who says they check every little thing their agent does with the same level of scrutiny as they would if they were doing it manually.

This ^^

There's a set of common needs across these gateways, and everyone is building their own proxies and reinventing the wheel, which just feels unnecessary.

~All of our customers at Oso (the launch partner in the article) have been asking us how to get a handle on this stuff...bc their CEO/board/whatever is asking them. So to us it was a no-brainer. (We're also Tailscale customers.)

Love to see it!

> yield to a tech CEO from San Francisco

ahem, he's from Utah duh bro

I've been doing this for a year or two. Love it, but haven't made it a thing across my team...and I'm not sure they love it as much as I do :P

> But first, before we get into Gas Town’s operation, I need to get rid of you real quick.

WARNING DANGER CAUTION GET THE F** OUT YOU WILL DIE

I have never met Steve, but this warning alone is :chefskiss:

Yes we've implemented this at Oso.

What a dempster fire

Say what you will -- East River Source Control is a great name

Props to this team for giving it their all

they don't actually "support" OPA. more like they run/depend on OPA

i know calvin, and he's one of the most authentic people i've worked with in tech. this could not be more off the mark

Love to see it

Curious to hear from the community about this, esp in light of article on supabase

This person is like the Gossip Guy of tech. Who cares?

Agreed! But you're glossing over the Zanzibar point of view on this topic, which falls back to dual-writes. That approach has a lot of downsides: "Unfortunately, when making writes to multiple systems, there are no easy answers."[0]

Having spoken with the actual creators of Zanzibar, they lament the massive challenge this design presents and the heroics they undertook over 7+ years at Google to overcome them.

By contrast, we're seeing lots of the best tech companies opt for approaches that let them leave the data in their source database wherever and as much as possible [1]

[0] https://authzed.com/blog/the-dual-write-problem

[1] https://www.osohq.com/post/local-authorization

I'm founder of Oso btw.

A classic

PIVOT

Inkeep has been great for us. Congrats on the launch!

I was wondering the same thing

This is the single-biggest drawback to purely Zanzibar-based architectures. The problem with requiring the authorization system to own all authorization data is that there’s really very little pure authorization data in any application. The majority of it is just application data that is sometimes used to make authorization decisions.

Here's a technical post that details these implications in practice: https://www.osohq.com/post/authorization-for-the-rest-of-us

And another post that describes an alternative approach, Oso: https://www.osohq.com/post/local-authorization

(Shocker: I'm cofounder/CEO of Oso)