Alrite, we have now retrofitted The Imago Platform with Permit.io ABAC. Ripping out the hacks, and enabling ABAC for document manager upload & retrieval, the frontend Workflow access filtering... qdrant db metadata fields, and passing attributes back and forth across a k8s Cluster and spinning up a large number of PDP's. Note To Self: Architect, design and build with Access Control from day 1. I'm not doing this again. Ever. You guys at Permit are brilliant, everything is super smooth, and ridiculously fast (20 qdrant points PDP filtering, 27 milliseconds) and we are very happy with everything. But retrofitting for ABAC... oh my days.

Love it! 🙂 Super happy to hear you are happy with the result.

Yes, now we have superpowers. One small thing that kept us awake, when setting up the ABAC Dynamic Resources, EQUALS is a literal string comparison, and EQUALS (ref) is the dynamic metadata field comparison. I know we're supposed to RTFM but this... can be easily overlooked. May I suggest a small help text in the interface "Literal String Comparison" and "Dynamic Metadata Field" tx

@david, @Ze'ev Manilovich - the man has a point

And, Claude does not know this (without a web search, which it has to be prompted to do) so when checking the PDP it sees the literal user.key (string) and thinks "looks good, must be the users permit.io unique user Key" - don't know about the other models, but Claude was unaware.

@Gabriel L. Manor - Sounds like some SEO/AEO fun task 😄

Hi @magnus186 just updating you that we added some helper text in the ABAC Rules setup. Thanks for the suggestion 🙂