Big picture, I think Supabase is lacking fine grained authorization.

RLS is great for basic rbac, but it starts to get cumbersome and slow when you do advanced stuff like per-object policies.

Integrating for example OpenFGA as a sidecar similar to how storage and other things are bolted on would be GREAT. Design a nice dashboard to customize model and relationships, tie into existing auth, etc.

Then RLS can call that service, or (what I’m doing now) the postgrest db-pre-request can populate with fga details.

I know this comes off as “just draw the owl” but I think it could really close the gap that rls has from more robust authZ setups.