Zanvex

Zanvex was my attempt at relationship-based access control inside Convex, based on Google's Zanzibar model. Permissions are stored as tuples, and a small rule language describes how they connect. A visual permission tester shows the path behind an allowed or denied request.

How I got there

In December 2025 I was working on sign-in and permissions for the booking component. I wanted a ready-made component for permissions, one call that answers whether a user may do something with an object. I built Zanvex over six days with Claude Code, with recording studios as the demo: two studio companies, admins, members, external customers and their bookings.

The idea that pulled me in was Zanzibar's New Enemy Problem. Google solves it with consistency tokens. In Convex, permission checks could run as ordinary reactive queries: when a relationship is deleted, every check that read it is invalidated and runs again. Permissions would also live in the same transactions as the application data, instead of behind an external API.

"Curious how others think about abstracting AuthZ into something like: can(user, "someAction", "someSubject")"My post in the Convex Discord, December 2025

Where it stalled

In my own test harness, walking the graph was too slow. Ian from the Convex team replied to my post with a second concern. Every permission check is a call into the component, and his rule of thumb was to keep those in the low tens per query or mutation.

"My only concern right now is if there will be too many calls to the component in a single query/mutation."Ian from the Convex team, replying in the Discord

A check that runs for every object fetched in a join would go far beyond that. Two weeks later I planned a successor with batched checks on top of OpenFGA's model, and it never got past the planning questions. In January 2026 convex-authz appeared. I shelved Zanvex.

What stayed

The booking component ended up on the other side of the line. It handles booking and nothing else; the host app decides who may do what. The code and demo of Zanvex are public, but I would not use it for production authorization.