https://imchintoo.github.io/rbac-fs/blog/Notes on file-based RBAC, multi-tenant architecture, and building rbac-fs in the open.https://imchintoo.github.io/rbac-fs/blog/the-first-question-in-every-access-postmortem.htmlhttps://imchintoo.github.io/rbac-fs/blog/the-first-question-in-every-access-postmortem.htmlTue, 25 Aug 2026 00:00:00 GMTWhen an access incident hits, the first question is never "how did the bug happen" — it's "who could do this, and who approved it." Here's why most teams can't answer that in under an hour, and what changes when the answer is a grep.https://imchintoo.github.io/rbac-fs/blog/can-file-based-rbac-scope-what-an-ai-agent-touches.htmlhttps://imchintoo.github.io/rbac-fs/blog/can-file-based-rbac-scope-what-an-ai-agent-touches.htmlMon, 24 Aug 2026 00:00:00 GMT2026's agent security data says the dominant failure mode is over-permissioning, not model behavior — here's an honest look at where folder-scoped RBAC actually helps, and where it runs out.https://imchintoo.github.io/rbac-fs/blog/why-rbac-fs-live-reload-never-races-its-own-writes.htmlhttps://imchintoo.github.io/rbac-fs/blog/why-rbac-fs-live-reload-never-races-its-own-writes.htmlFri, 21 Aug 2026 00:00:00 GMTThe specific chokidar configuration and cache-invalidation ordering that keep rbac-fs's live-reload from ever serving a role it just wrote itself, or missing an edit from someone else.https://imchintoo.github.io/rbac-fs/blog/what-a-quarterly-access-review-actually-costs-you.htmlhttps://imchintoo.github.io/rbac-fs/blog/what-a-quarterly-access-review-actually-costs-you.htmlWed, 19 Aug 2026 00:00:00 GMTSOC 2 doesn't just want you to review access quarterly — it wants evidence for every quarter, and most teams are paying for that in engineering-manager hours nobody budgeted.https://imchintoo.github.io/rbac-fs/blog/signs-your-rbac-model-is-about-to-outgrow-itself.htmlhttps://imchintoo.github.io/rbac-fs/blog/signs-your-rbac-model-is-about-to-outgrow-itself.htmlTue, 18 Aug 2026 00:00:00 GMTThe concrete symptoms that separate "this needs a condition" from "this needs a relationship graph" — and the honest, incremental path if you're actually in the second category.https://imchintoo.github.io/rbac-fs/blog/rbac-fs-vs-opa-vs-zanzibar-style-authorization.htmlhttps://imchintoo.github.io/rbac-fs/blog/rbac-fs-vs-opa-vs-zanzibar-style-authorization.htmlMon, 17 Aug 2026 00:00:00 GMTOPA/Rego and Zanzibar-style engines like OpenFGA and SpiceDB solve real problems rbac-fs doesn't — here's what each actually costs to operate, and an honest line for where rbac-fs stops being the right tool.https://imchintoo.github.io/rbac-fs/blog/the-authorization-cost-nobody-is-pricing-in.htmlhttps://imchintoo.github.io/rbac-fs/blog/the-authorization-cost-nobody-is-pricing-in.htmlSun, 16 Aug 2026 00:00:00 GMTThe build-vs-buy literature treats authorization as a choice between building a service and buying one, but the cost data both sides cite actually argues for a third option neither names.https://imchintoo.github.io/rbac-fs/blog/why-the-permission-check-has-zero-dependencies.htmlhttps://imchintoo.github.io/rbac-fs/blog/why-the-permission-check-has-zero-dependencies.htmlFri, 14 Aug 2026 00:00:00 GMT2026's npm supply-chain attacks got names and dates — here's why the code path that decides who's allowed to do what is the worst place to carry that exposure, and what rbac-fs does about it specifically.https://imchintoo.github.io/rbac-fs/blog/permission-drift-is-a-solved-problem-in-iac-not-in-rbac.htmlhttps://imchintoo.github.io/rbac-fs/blog/permission-drift-is-a-solved-problem-in-iac-not-in-rbac.htmlThu, 13 Aug 2026 00:00:00 GMTInfrastructure teams spent years naming and tooling against "drift" — the gap between declared and enforced state. Most RBAC systems have the exact same failure mode and no name for it.https://imchintoo.github.io/rbac-fs/blog/what-a-due-diligence-checklist-finds-in-your-authorization-layer.htmlhttps://imchintoo.github.io/rbac-fs/blog/what-a-due-diligence-checklist-finds-in-your-authorization-layer.htmlWed, 12 Aug 2026 00:00:00 GMTSOC 2 auditors and acquisition due-diligence teams both eventually ask who can do what and prove it — here's what they check, and how rbac-fs answers most of it without extra tooling.https://imchintoo.github.io/rbac-fs/blog/why-file-based-rbac-beats-a-policy-blob.htmlhttps://imchintoo.github.io/rbac-fs/blog/why-file-based-rbac-beats-a-policy-blob.htmlWed, 12 Aug 2026 00:00:00 GMTGit-diffable roles aren't a gimmick — they change who can review a permission change, and when, compared to an opaque policy blob in a database.https://imchintoo.github.io/rbac-fs/blog/rbac-fs-vs-casbin-vs-casl.htmlhttps://imchintoo.github.io/rbac-fs/blog/rbac-fs-vs-casbin-vs-casl.htmlMon, 10 Aug 2026 00:00:00 GMTThree real libraries, three different trade-offs — storage model, framework coverage, and what happens when you need to audit a permission change.https://imchintoo.github.io/rbac-fs/blog/multi-tenant-permissions-without-a-database.htmlhttps://imchintoo.github.io/rbac-fs/blog/multi-tenant-permissions-without-a-database.htmlSat, 08 Aug 2026 00:00:00 GMTFolder isolation instead of a WHERE clause — what that structurally buys you for tenant isolation, and where it stops being enough at real scale.https://imchintoo.github.io/rbac-fs/blog/how-rbac-fs-resolves-a-permission-check.htmlhttps://imchintoo.github.io/rbac-fs/blog/how-rbac-fs-resolves-a-permission-check.htmlFri, 07 Aug 2026 00:00:00 GMTWhat actually happens between calling can() and getting true or false back — role loading, inheritance, and condition evaluation, in order.https://imchintoo.github.io/rbac-fs/blog/building-your-first-permission-check.htmlhttps://imchintoo.github.io/rbac-fs/blog/building-your-first-permission-check.htmlWed, 05 Aug 2026 00:00:00 GMTA tutorial-paced walkthrough of installing rbac-fs, creating a role, and running your first can() check, in both JavaScript and TypeScript.https://imchintoo.github.io/rbac-fs/blog/runtime-role-management-no-redeploy.htmlhttps://imchintoo.github.io/rbac-fs/blog/runtime-role-management-no-redeploy.htmlMon, 03 Aug 2026 00:00:00 GMTA permission system that requires a deploy to add one role is solving the wrong problem — how rbac-fs makes role changes a runtime operation instead.https://imchintoo.github.io/rbac-fs/blog/tutorial-create-grant-revoke-delete-roles.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-create-grant-revoke-delete-roles.htmlSat, 01 Aug 2026 00:00:00 GMTA hands-on walkthrough of every dynamic role management call in rbac-fs, with the actual file contents shown at each step.https://imchintoo.github.io/rbac-fs/blog/every-allow-and-deny-logged.htmlhttps://imchintoo.github.io/rbac-fs/blog/every-allow-and-deny-logged.htmlThu, 30 Jul 2026 00:00:00 GMTHow rbac-fs's built-in audit trail works — JSONL format, why not a single JSON array, and what's actually in each record.https://imchintoo.github.io/rbac-fs/blog/tutorial-querying-and-rotating-audit-logs.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-querying-and-rotating-audit-logs.htmlTue, 28 Jul 2026 00:00:00 GMTA hands-on walkthrough of configuring log rotation and querying audit history in rbac-fs, including what each rotation option actually controls.https://imchintoo.github.io/rbac-fs/blog/conditional-permissions-in-rbac-fs.htmlhttps://imchintoo.github.io/rbac-fs/blog/conditional-permissions-in-rbac-fs.htmlSun, 26 Jul 2026 00:00:00 GMTBeyond allow or deny — how rbac-fs's condition system handles "approve your own expense report" without reaching for eval() or a rules engine.https://imchintoo.github.io/rbac-fs/blog/tutorial-building-a-condition-tree.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-building-a-condition-tree.htmlFri, 24 Jul 2026 00:00:00 GMTStep-by-step construction of an AND/OR condition tree in rbac-fs, from a single clause to a nested, real-world approval rule.https://imchintoo.github.io/rbac-fs/blog/tutorial-setting-up-multi-tenant-roles.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-setting-up-multi-tenant-roles.htmlWed, 22 Jul 2026 00:00:00 GMTA hands-on walkthrough of tenant-scoped and shared roles in rbac-fs, including the path-sanitization behavior you should verify yourself.https://imchintoo.github.io/rbac-fs/blog/hand-editing-roles-and-live-reload.htmlhttps://imchintoo.github.io/rbac-fs/blog/hand-editing-roles-and-live-reload.htmlMon, 20 Jul 2026 00:00:00 GMTRole files are cached in memory for speed — here's how rbac-fs's chokidar-backed watcher keeps that cache honest when someone edits a file by hand.https://imchintoo.github.io/rbac-fs/blog/tutorial-hand-editing-and-live-reload.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-hand-editing-and-live-reload.htmlSat, 18 Jul 2026 00:00:00 GMTA step-by-step demo of rbac-fs's live-reload — edit a role JSON file directly and see the permission change without restarting anything.https://imchintoo.github.io/rbac-fs/blog/permissions-in-the-browser-without-a-filesystem.htmlhttps://imchintoo.github.io/rbac-fs/blog/permissions-in-the-browser-without-a-filesystem.htmlThu, 16 Jul 2026 00:00:00 GMTrbac-fs's Node core never belongs in a browser bundle — here's how RBACClient gives the frontend the same can() call without any filesystem dependency.https://imchintoo.github.io/rbac-fs/blog/tutorial-rbacclient-without-a-framework.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-rbacclient-without-a-framework.htmlTue, 14 Jul 2026 00:00:00 GMTA vanilla-JS walkthrough of RBACClient — useful on its own, and as the mental model underneath every rbac-fs frontend framework adapter.https://imchintoo.github.io/rbac-fs/blog/guardrails-you-dont-have-to-build-yourself.htmlhttps://imchintoo.github.io/rbac-fs/blog/guardrails-you-dont-have-to-build-yourself.htmlSun, 12 Jul 2026 00:00:00 GMTrbac-fs bakes path sanitization, schema validation, reserved names, and circular-inheritance detection into Core Engine, not left to consumers.https://imchintoo.github.io/rbac-fs/blog/tutorial-verifying-security-guardrails.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-verifying-security-guardrails.htmlFri, 10 Jul 2026 00:00:00 GMTDon't take the docs' word for it — four runnable snippets proving path sanitization and circular-inheritance detection actually reject what they claim to.https://imchintoo.github.io/rbac-fs/blog/nestjs-guards-decorators-and-fail-open-routes.htmlhttps://imchintoo.github.io/rbac-fs/blog/nestjs-guards-decorators-and-fail-open-routes.htmlWed, 08 Jul 2026 00:00:00 GMTrbac-fs's NestJS adapter is opt-in per route via @RequirePermission() — a route with no decorator is allowed through unchecked, deliberately.https://imchintoo.github.io/rbac-fs/blog/tutorial-nestjs-rbacguard-walkthrough.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-nestjs-rbacguard-walkthrough.htmlMon, 06 Jul 2026 00:00:00 GMTA runnable walkthrough of rbac-fs's NestJS guard and decorator, driving RbacGuard directly so you can see every outcome without booting a full Nest app.https://imchintoo.github.io/rbac-fs/blog/one-middleware-shape-express-koa-fastify.htmlhttps://imchintoo.github.io/rbac-fs/blog/one-middleware-shape-express-koa-fastify.htmlSat, 04 Jul 2026 00:00:00 GMTrbac-fs's Express, Koa, and Fastify adapters share the same rbacMiddleware shape — here's what stays the same and what each framework forces to differ.https://imchintoo.github.io/rbac-fs/blog/tutorial-express-rbac-middleware.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-express-rbac-middleware.htmlThu, 02 Jul 2026 00:00:00 GMTA runnable, curl-able Express example — one guarded route, three requests, three different outcomes, and the auth-ordering rule that makes it work.https://imchintoo.github.io/rbac-fs/blog/why-the-fastify-adapter-is-a-plugin-not-middleware.htmlhttps://imchintoo.github.io/rbac-fs/blog/why-the-fastify-adapter-is-a-plugin-not-middleware.htmlTue, 30 Jun 2026 00:00:00 GMTrbac-fs's Fastify adapter must be registered at the root app, not inside an encapsulated sub-plugin — the encapsulation rule that makes that a hard requirement.https://imchintoo.github.io/rbac-fs/blog/tutorial-fastify-rbac-plugin.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-fastify-rbac-plugin.htmlSun, 28 Jun 2026 00:00:00 GMTA runnable Fastify example covering plugin registration, per-route rbac config, and both the allowed and denied response paths.https://imchintoo.github.io/rbac-fs/blog/koa-ctx-state-and-async-native-middleware.htmlhttps://imchintoo.github.io/rbac-fs/blog/koa-ctx-state-and-async-native-middleware.htmlFri, 26 Jun 2026 00:00:00 GMTrbac-fs's Koa adapter shares Express's rbacMiddleware signature but reads the user from ctx.state — Koa's own documented convention, not an arbitrary choice.https://imchintoo.github.io/rbac-fs/blog/tutorial-koa-rbac-middleware.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-koa-rbac-middleware.htmlWed, 24 Jun 2026 00:00:00 GMTA runnable Koa example — same rbacMiddleware shape as Express, ctx.state instead of req.user, three requests and three outcomes.https://imchintoo.github.io/rbac-fs/blog/declarative-permissions-in-react-with-can.htmlhttps://imchintoo.github.io/rbac-fs/blog/declarative-permissions-in-react-with-can.htmlMon, 22 Jun 2026 00:00:00 GMTrbac-fs's React adapter follows CASL's I/a naming convention on purpose — one less thing to relearn if your team already knows CASL's mental model.https://imchintoo.github.io/rbac-fs/blog/tutorial-react-adapter-headless-testing.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-react-adapter-headless-testing.htmlSat, 20 Jun 2026 00:00:00 GMTA headless react-test-renderer walkthrough of <Can>, RbacProvider, and usePermission() — the same technique the adapter's own test suite uses.https://imchintoo.github.io/rbac-fs/blog/vue-v-can-directive-display-none-vs-unmount.htmlhttps://imchintoo.github.io/rbac-fs/blog/vue-v-can-directive-display-none-vs-unmount.htmlThu, 18 Jun 2026 00:00:00 GMTrbac-fs's v-can directive toggles display:none like v-show — a deliberate choice, different from the true unmount you get from rbac-fs's Angular and React adapters.https://imchintoo.github.io/rbac-fs/blog/tutorial-vue-adapter-headless-verify.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-vue-adapter-headless-verify.htmlTue, 16 Jun 2026 00:00:00 GMTA runnable, no-browser walkthrough of rbac-fs's Vue plugin, v-can directive, and usePermission() composable using the same verification approach as its test suite.https://imchintoo.github.io/rbac-fs/blog/angular-rbaccan-real-unmount-like-ngif.htmlhttps://imchintoo.github.io/rbac-fs/blog/angular-rbaccan-real-unmount-like-ngif.htmlSun, 14 Jun 2026 00:00:00 GMTrbac-fs's Angular adapter does a real ViewContainerRef unmount/remount, matching *ngIf's own public API instead of a display:none toggle.https://imchintoo.github.io/rbac-fs/blog/tutorial-angular-rbaccan-verify.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-angular-rbaccan-verify.htmlFri, 12 Jun 2026 00:00:00 GMTA runnable walkthrough that drives RbacService and RbacCanDirective directly with a fake ViewContainerRef — the same approach the adapter's own test suite uses.https://imchintoo.github.io/rbac-fs/blog/svelte-stores-and-actions-not-context.htmlhttps://imchintoo.github.io/rbac-fs/blog/svelte-stores-and-actions-not-context.htmlWed, 10 Jun 2026 00:00:00 GMTrbac-fs's Svelte adapter closes over an explicit RBACClient instead of Svelte's context API — favoring traceability over implicit wiring.https://imchintoo.github.io/rbac-fs/blog/tutorial-svelte-adapter-headless-verify.htmlhttps://imchintoo.github.io/rbac-fs/blog/tutorial-svelte-adapter-headless-verify.htmlMon, 08 Jun 2026 00:00:00 GMTA runnable, no-browser walkthrough of createPermissionStore and createCanAction — the store and action primitives underneath rbac-fs's Svelte adapter.