I love seeing stories like this. They are such a great reminder how hard it is to get a permissions and user authorization system right. It wasn't that long ago we also took up that challenge at Authress and found a lot of the same benefits menetioned here. I wish it was simpler to get this level of quality and functionality in such important systems without needing to run an enterprise level fully staffed security, appsec, and infosec team.