Authorization

Roles that contain roles: an RBAC resolved by a recursive Postgres query

When a role can inherit other roles, permissions stop being a list and become a graph — and graphs are where the ORM taps out. Here's a role system resolved in one WITH RECURSIVE query, cached per tenant, and enforced through method_missing.