Audience question: Pundit lets you define scopes within a policy for filtering collections — what is the pattern with relationship-based access control? Answer: ReBAC doesn't give you that for free; you have to explicitly query the graph. Pundit is a 'black box of logic' that accepts any Ruby code, while FGA is intentionally constrained — you must declare relations, which is a trade-off.