but realistically, for anything beyond the basics, you'll need either a policy engine (which is fully open ended so powerful but inefficient) or ReBAC