How we rebuilt complex permissions without migrating to Zanzibar

Why we picked it · the editor's summary

Infisical's old Additional Privileges screen listed every possible permission and could not subtract access, so admins either misconfigured it or over-granted. Moving to SpiceDB or OpenFGA would have meant rewriting every permission check and asking each self-hosted customer to run another stateful service, so the team added five-tier folder grants beside the old model: legacy rows keep null in the new columns and keep working, and checks stop any row from using both. Where it bent was caching: keying compiled rules on folder IDs, then on paths, both broke on renames, and what shipped is a per-project version counter bumped on every write. If someone keeps proposing a rewrite of your authorization layer, this is the cost accounting for the alternative.