Yatish Mehta's summary recommendation: start simple with Pundit; when the app's permission model outgrows policies, add a fine-grained authorization layer like granity; and once the system becomes truly distributed (microservices), consider an external authorization-as-a-service (OpenFGA, Oso, permit.io).