Moving Authorization Out of Your App Code: If-Statements vs. Cerbos vs. SpiceDB
Comments on “Moving Authorization Out of Your App Code: If-Statements vs. Cerbos vs. SpiceDB”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
DevOps Daily built one permission model three ways (if-statements, Cerbos, SpiceDB), grew it over four steps, and checked each against 84 hand-written decisions. On a Raspberry Pi 4 with 10,000 documents, median single checks took 0.14 ms, 3.8 ms and 10.8 ms. A member's list took 4.4 ms in SQL, 11.9–31.6 ms via Cerbos and 77–404 ms via SpiceDB. Every design still needed application changes for a late rule. The timings come from one setup and the Cerbos–SpiceDB timing figures have no independent source.
Why it ranked
No. 7 of 107 with a score of 0.71. The panel rated it highest on substantiated (0.93) and technical depth (0.92), lowest on significance (0.54). Placed No. 7, No. 6 by score alone: the fourth Security story of the day (−0.020). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Rigorous, well-substantiated benchmark comparing authorization designs with reproducible repo and detailed numbers; highly practical for builders, though niche in audience and not a landmark.
- AI judgeJudge 3gpt-5.6-luna
- A highly reproducible authorization comparison with code, measurements, correctness tests, caveats, and actionable design guidance. It is technically deep and broadly useful, though results are constrained by the Raspberry Pi setup and non-nested model.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.71total under rubric v2.3
- Significance0.54
- Reader interest0.79
- Audience breadth0.59
- Practical relevance0.86
- Substantiated0.93
- Technical depth0.92
- New information0.88
- Counts against: Promotional0.09
- Counts against: Overclaim0.15
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.60 | 0.35 | 0.68 | 0.54 | 0.33 | +0.24 | +0.130 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.77 | 0.70 | 0.90 | 0.79 | 0.20 | +0.26 | +0.205 |
| Audience breadthHow many people who build technology does it concern? | 0.66 | 0.50 | 0.62 | 0.59 | 0.16 | +0.13 | +0.077 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.92 | 0.80 | 0.88 | 0.86 | 0.12 | +0.22 | +0.190 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 1.00 | 0.85 | 0.95 | 0.93 | 0.15 | +0.05 | +0.047 |
| Technical depthHow technically substantive is it? | 1.00 | 0.85 | 0.90 | 0.92 | 0.15 | +0.05 | +0.046 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.88 | 0.80 | 0.95 | 0.88 | 0.15 | +0.05 | +0.044 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.04 | 0.20 | 0.02 | 0.09 | 0.18 | −0.19 | −0.016 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.21 | 0.20 | 0.04 | 0.15 | 0.17 | −0.11 | −0.017 |
| Sum of contributions | +0.706 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.707 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-03/7/"><img src="https://rubric.hrih.si/badge/2026-11-03/7.svg" alt="Ranked #7 on Rubric, 3 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 4 matches source · 4 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceQuote
SpiceDB's in-memory datastore is described in SpiceDB's docs as intended for testing integrations.
The cited source says the same thing.
The article says “SpiceDB 1.57.0 with its in-memory datastore, which its docs describe as intended for testing integrations”
The source says “Intended for usage with SpiceDB itself and testing application integrations”
Source cited by the article: authzed.com/docs/spicedb/concepts/datastores
Matches sourceQuote
SpiceDB's own guide suggests using LookupResources when a user can see fewer than about 10,000 resources, and otherwise fetching candidates from the app database and filtering them with CheckBulkPermissions.
The cited source says the same thing.
The article says “suggests LookupResources when a user can see fewer than about 10,000 resources, and otherwise fetching a page of candidates from your own database and filtering them with CheckBulkPermissions”
The source says “If the number of resources that a user has access to is small (e.g. less than 10,000 resources), you can use the LookupResources API to get the full list of…”
Source cited by the article: authzed.com/docs/spicedb/modeling/protecting-a-list-endpoint
Matches sourceCausal conclusion
A SpiceDB repository issue explains that two paths to the same resource can produce duplicate results in cursored LookupResources calls, a known limitation, and recommends client-side de-duplication.
The cited source says the same thing.
The article says “an issue in the SpiceDB repository explains that two paths to the same resource can produce two results”
The source says “In the case of there being two (or more) paths to the same resource+permission, you can get duplicate results out of LR (and this is expected behavior”
Source cited by the article: github.com/authzed/spicedb/issues/3190
Matches sourceQuote
Cerbos docs say that with reject enforcement of schema validation, every action of an invalid request is denied.
The cited source says the same thing.
The article says “with reject enforcement, its docs say every action of an invalid request is denied”
The source says “If enforcement level is reject and the request is invalid according to the schema, the effect for all actions will be set to EFFECT_DENY”
Source cited by the article: docs.cerbos.dev/cerbos/latest/policies/schemas
No source givenNumber
Median single-check latency on the Raspberry Pi 4 was 0.14 ms for if-statements, 3.8 ms for Cerbos and 10.8 ms for SpiceDB.
The article gives no link or citation for it.
The article says “The if-statements answered in 0.14 ms. Cerbos took 3.8 ms and SpiceDB 10.8 ms (median p50”
The source says No source to compare with.
No source givenNumber
For a typical member, listing took 4.4 ms as SQL, 11.9 to 31.6 ms through Cerbos, and 404 ms cold (77 ms warm) through SpiceDB.
The article gives no link or citation for it.
The article says “took 4.4 ms as SQL, 11.9 to 31.6 ms through a Cerbos query plan turned into SQL”
The source says No source to compare with.
No source givenCausal conclusion
The late rule made SpiceDB's cold list about 3.5 times slower, with the admin's cold list going from 928 ms at step 3 to 3,204 ms at step 4.
The article gives no link or citation for it.
The article says “The late rule made SpiceDB's cold lists about 3.5 times slower”
The source says No source to compare with.
No source givenNumber
Total lines changed over the four steps were 83 for if-statements, 211 for Cerbos and 187 for SpiceDB.
The article gives no link or citation for it.
The article says “Lines changed over the four steps: 83 for if-statements, 211 for Cerbos, 187 for SpiceDB”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 3 Nov 2026, 05:47 UTC. It played no part in the ranking.