Comment by lexicality

The lack of object level permissions is a really spectacular footgun and the fact that it's not even on the roadmap is concerning.

Want to allow users to set their own name? I hope you're OK with any user being able to update any field of any other user too!

Added a new entry and didn't specify a policy for every single available action? They default to unauthenticated access!

> If no policy is specified for a rule, the access is public for the related action, thus anyone can manage records.

Aaaaaa!