wroclove.rb 2025 talk by Yatish Mehta ('Unduple the power of Rails authorization'). Walks through implicit query-scope authorization, CanCan, Pundit / action_policy, and their scaling/refactoring/performance/auditability limits, then introduces Fine-Grained Authorization (FGA, a.k.a. relationship-based access control) based on Google's Zanzibar paper. Uses a project-management app (users, teams, projects, tasks, admin/editor/commenter roles; sensitive-task rule) as the worked example. Presents the author's granity gem, which stores relationships as tuples, navigates them as a graph, supports smart caching, reverse lookups and permission-path audit. Also surveys external FGA-as-a-service providers. Summary path: start with Pundit, add granity for FGA, adopt an external authorization service for truly distributed systems.