Zanvex

Zanvex was my attempt at relationship-based access control inside Convex, based on Google’s Zanzibar model. Permissions are stored as tuples, and a small rule language describes how they connect. I built a visual permission tester so I could see the path behind an allowed or denied request.

What I was after

I wanted permission checks to run as ordinary Convex queries and mutations. That would keep them in the same system as the application data and let changes to a relationship update the affected screens.

Where it stalled

I got stuck on performance. Walking the graph was too slow for the workloads I wanted to support, and I had not worked out what to precompute. Around the same time, convex-authz appeared in the Convex directory, and I no longer needed Zanvex for the project that had prompted it. I shelved it.

What stayed

Building the rule language and permission tester helped me understand Convex better. The traversal work also showed me where I needed more knowledge about graph indexing and precomputation. The code and demo are public, but I would not use it for production authorization.