← Extractions

No 'Pundit' Intended — Rails Authorization by Yatish Mehta

At wroclove.rb 2025, Yatish Mehta (Asana) surveys Rails authorization approaches — implicit scopes, CanCan, Pundit — and their scaling problems, then introduces Fine-Grained Authorization (FGA / ReBAC) based on Google's Zanzibar. He presents his gem granity, which brings relationship-based access control with schema, tuples, smart caching, reverse lookups and audit paths to Rails apps, with Q&A on modeling sensitive tasks and syncing relationships.

Model

claude-opus-4-7

Ingestion

623af82e

Input tokens

197,088

fresh: 131,154
cached: 59,034
cache write: 6,900

Output tokens

9,848

Duration

138.7s

Roundtrips

Tool calls

Cost

$0.00

Nodes/edges extracted

22 / 40

Read set (nodes/edges)

83 / 1

Nodes (22)

create permit.io tool

kind (empty) → tool

name (empty) → permit.io

slug (empty) → permit-io

attrs (empty) → {"category" => "service"}

description (empty) → Authorization-as-a-service provider (permit.io) based on Google's Zanzibar model. Surveyed by Yatish Mehta alongside ...

short_description (empty) → Authorization-as-a-service provider based on Zanzibar-style FGA.

create Figma company

kind (empty) → company

name (empty) → Figma

slug (empty) → figma

attrs (empty) → {"industry" => "design tools / SaaS"}

description (empty) → Collaborative design company. Referenced by Yatish Mehta via a Figma engineering blog post stating that around 23% of...

short_description (empty) → Collaborative design platform.

create Implicit Authorization concept

kind (empty) → concept

name (empty) → Implicit Authorization

slug (empty) → implicit-authorization

attrs (empty) → {"category" => "pattern"}

description (empty) → Authorization approach where access control is implicit in the query: for example, fetching a project scoped to the c...

short_description (empty) → Relying on query scopes to enforce access rather than explicit checks.

update Yatish Mehta person

attrs (empty) → {"role" => "Tech Lead, Authorization", "location" => "San Francisco, California, USA"}

description Conference speaker. → Rubyist for 10+ years based in San Francisco, California. Tech lead for authorization at Asana (HQ San Francisco, eng...

short_description Conference speaker. → Ruby developer, Asana authorization tech lead, author of granity gem.

update No 'Pundit' Intended talk

description Talk at wroclove.rb 2025. → wroclove.rb 2025 talk by Yatish Mehta ('Unduple the power of Rails authorization'). Walks through implicit query-scop...

short_description Talk at wroclove.rb 2025. → Survey of Rails authorization approaches leading to fine-grained, relationship-based access control.

create Asana company

kind (empty) → company

name (empty) → Asana

slug (empty) → asana

attrs (empty) → {"office" => "Warsaw, Poland", "industry" => "work collaboration / productivity SaaS", "headquarters" => "San Francis...

description (empty) → Work collaboration platform for managing projects and tasks. HQ in San Francisco with an engineering office in Warsaw...

short_description (empty) → Work collaboration platform for projects and tasks.

create Authentication concept

kind (empty) → concept

name (empty) → Authentication

slug (empty) → authentication

attrs (empty) → {"category" => "practice"}

description (empty) → Security concept dealing with identifying and verifying who a user is — username/password, SSO, SAML. Contrasted with...

short_description (empty) → Verifying who a user claims to be.

create Authorization concept

kind (empty) → concept

name (empty) → Authorization

slug (empty) → authorization

attrs (empty) → {"category" => "practice"}

description (empty) → Security concept dealing with what a user is allowed to do — which actions and permissions are granted to them once i...

short_description (empty) → Determining what actions or resources a user is allowed to access.

create CanCan tool

kind (empty) → tool

name (empty) → CanCan

slug (empty) → cancan

attrs (empty) → {"category" => "library"}

description (empty) → Authorization gem for Rails using a central ability.rb file that defines rules and permissions per user role and reso...

short_description (empty) → Ruby authorization gem centralizing abilities in a single file.

create action_policy tool

kind (empty) → tool

name (empty) → action_policy

slug (empty) → action_policy

attrs (empty) → {"category" => "library"}

description (empty) → Ruby authorization gem described by Yatish Mehta as 'a revised version of Pundit with additional features' — same str...

short_description (empty) → Revised Pundit-style Ruby authorization gem with additional features.

update Pundit tool

description Popular Ruby authorization gem. Meedan adopted Pundit when they first built Check with GraphQL, because graphql-ruby ... → Most popular Rails authorization gem. Provides Plain-Old-Ruby policy classes paired with resources, where each instan...

create Fine-Grained Authorization concept

kind (empty) → concept

name (empty) → Fine-Grained Authorization

slug (empty) → fine-grained-authorization

attrs (empty) → {"aliases" => "FGA; ReBAC; Relationship-Based Access Control", "category" => "architecture"}

description (empty) → Fine-Grained Authorization (FGA), also called Relationship-Based Access Control (ReBAC). Based on Google's Zanzibar p...

short_description (empty) → Relationship-based access control modeling permissions as a graph of tuples.

create Google Zanzibar resource

kind (empty) → resource

name (empty) → Google Zanzibar

slug (empty) → google-zanzibar

attrs (empty) → {"type" => "article"}

description (empty) → Google paper describing Zanzibar, Google's distributed authorization system used across their products. Foundation fo...

short_description (empty) → Google paper describing their distributed authorization system.

create granity tool

kind (empty) → tool

name (empty) → granity

slug (empty) → granity

attrs (empty) → {"license" => "open-source", "category" => "library", "language" => "Ruby"}

description (empty) → Ruby gem created by Yatish Mehta to support Fine-Grained Authorization in Rails apps. On install it adds a migration ...

short_description (empty) → Ruby gem bringing fine-grained (relationship-based) authorization to Rails.

create OpenFGA tool

kind (empty) → tool

name (empty) → OpenFGA

slug (empty) → openfga

attrs (empty) → {"category" => "service"}

description (empty) → Open-source Fine-Grained Authorization service inspired by Google's Zanzibar paper. Provides its own modeling DSL, a ...

short_description (empty) → Open-source authorization-as-a-service based on Google Zanzibar.

create Oso tool

kind (empty) → tool

name (empty) → Oso

slug (empty) → oso

attrs (empty) → {"category" => "service"}

description (empty) → Authorization-as-a-service platform (OSO) inspired by Google's Zanzibar. One of several external FGA providers survey...

short_description (empty) → Authorization-as-a-service platform based on Zanzibar-style modeling.

create Start with Pundit, add granity for FGA, adopt authorization-as-a-service at distributed scale takeaway

kind (empty) → takeaway

name (empty) → Start with Pundit, add granity for FGA, adopt authorization-as-a-service at distributed scale

slug (empty) → start-with-pundit-add-granity-for-fga-adopt-authorization-as-a-service-at-distributed-scale

attrs (empty) → {"type" => "recommendation"}

description (empty) → Yatish Mehta's summary recommendation: start simple with Pundit; when the app's permission model outgrows policies, a...

short_description (empty) → Progressive path for Rails authorization complexity.

create Model permissions as a graph, check them as path existence takeaway

kind (empty) → takeaway

name (empty) → Model permissions as a graph, check them as path existence

slug (empty) → model-permissions-as-a-graph-check-them-as-path-existence

attrs (empty) → {"type" => "insight"}

description (empty) → Core insight of FGA/ReBAC as presented by Yatish Mehta: rather than evaluating black-box per-permission logic, store ...

short_description (empty) → Frame authorization as graph reachability over relationship tuples.

create Tuples must be kept in sync with domain data takeaway

kind (empty) → takeaway

name (empty) → Tuples must be kept in sync with domain data

slug (empty) → tuples-must-be-kept-in-sync-with-domain-data

attrs (empty) → {"type" => "warning"}

description (empty) → Warning from Yatish Mehta: using FGA effectively duplicates many-to-many/foreign-key relationships from your domain m...

short_description (empty) → Moving many-to-many relationships into an FGA store creates a sync obligation.

create How to model sensitive tasks in FGA? question

kind (empty) → question

name (empty) → How to model sensitive tasks in FGA?

slug (empty) → how-to-model-sensitive-tasks-in-fga

attrs (empty) → {"answer_summary" => "Introduce a sensitive_task entity related to task via an 'is_sensitive' relation; the authoriza...

description (empty) → Audience question asking how Yatish Mehta's sensitive-task rule (only admins can edit a sensitive task) is modeled in...

short_description (empty) → Q&A: representing a sensitive-task override in the authorization schema.

create How hard is it to keep authorization relationships in sync? question

kind (empty) → question

name (empty) → How hard is it to keep authorization relationships in sync?

slug (empty) → how-hard-is-it-to-keep-authorization-relationships-in-sync

attrs (empty) → {"answer_summary" => "Yes, it's a real overhead; duplicate relevant relationships into tuples and keep them in sync v...

description (empty) → Audience question about the difficulty of keeping tuples consistent with domain models. Answer: it is a real challeng...

short_description (empty) → Q&A: operational cost of maintaining tuples alongside domain data.

create Defining scopes with relationship-based access control question

kind (empty) → question

name (empty) → Defining scopes with relationship-based access control

slug (empty) → defining-scopes-with-relationship-based-access-control

attrs (empty) → {"answer_summary" => "ReBAC has no built-in scope mechanism; you must explicitly query the relationship graph. Pundit...

description (empty) → Audience question: Pundit lets you define scopes within a policy for filtering collections — what is the pattern with...

short_description (empty) → Q&A: equivalent of Pundit scopes in ReBAC-based authorization.

Edges (40)

update Yatish Mehta → authored → No 'Pundit' Intended

context (empty) → Yatish delivered this talk at wroclove.rb 2025.

update No 'Pundit' Intended → presented_at → wroclove.rb 2025

context (empty) → Talk delivered at the March 2025 edition of wroclove.rb.

create Yatish Mehta → works_at → Asana

attrs (empty) → {"role" => "Tech Lead, Authorization"}

context (empty) → Tech lead for authorization at Asana, based in San Francisco with an engineering office in Warsaw.

relation (empty) → works_at

source_node_id (empty) → 98f7dc64-d973-47e7-8f82-2dde7d2d640a

target_node_id (empty) → f751cc3c-2cee-4cb8-a5bf-c8083d983313

create Yatish Mehta → works_on → granity

attrs (empty) → {"role" => "author"}

context (empty) → Author/creator of the granity gem for FGA in Rails.

relation (empty) → works_on

source_node_id (empty) → 98f7dc64-d973-47e7-8f82-2dde7d2d640a

target_node_id (empty) → ac1d7f2b-90f8-4c70-9e40-175c5ac985e4

create No 'Pundit' Intended → about → Authentication

context (empty) → Talk introduces the authentication vs authorization distinction.

relation (empty) → about