{"slug": "show-hn-zenstack-access-control-at-the-orm-layer-built-for-coding-agents", "title": "Show HN: ZenStack – access control at the ORM layer, built for coding agents", "summary": "Jiasheng, co-creator of ZenStack, launched a tool that enforces access control (RBAC/ABAC/relation-based) at the ORM layer on top of Kysely, ensuring every database query is authorized regardless of who writes the code. The approach aims to reduce security risks from missing authorization checks, especially when code is generated by AI agents, and is database-agnostic unlike PostgreSQL Row-Level Security.", "body_md": "Hi HN, I'm Jiasheng, co-creator of ZenStack.\n\nAccess control usually ends up scattered across app code instead of living with the data model — and that's riskier when the code is written by an agent, since it's easy to ship a query with a missing or incomplete authorization check. ZenStack enforces policy (RBAC/ABAC/relation-based) directly at the ORM layer, on top of Kysely, so every query gets checked the same way regardless of who wrote it and who is calling it.\n\nPostgres RLS is an option too, but it's hard to maintain and scale, and it's Postgres-only — ZenStack's approach is database-agnostic.\n\nOne of our users, MermaidChart, put it well after launching their team feature on ZenStack: \"much cleaner and easier to maintain than writing RLS policies or application-level checks that will surely leak after some time.\"\n\nHappy to answer anything.\n\nComments URL: [https://news.ycombinator.com/item?id=48903199](https://news.ycombinator.com/item?id=48903199)\n\nPoints: 1\n\n# Comments: 0", "url": "https://wpnews.pro/news/show-hn-zenstack-access-control-at-the-orm-layer-built-for-coding-agents", "canonical_source": "https://zenstack.framer.website/", "published_at": "2026-07-14 07:08:27+00:00", "updated_at": "2026-07-14 07:18:27.127244+00:00", "lang": "en", "topics": ["ai-safety", "developer-tools", "ai-agents"], "entities": ["ZenStack", "Jiasheng", "Kysely", "MermaidChart"], "alternates": {"html": "https://wpnews.pro/news/show-hn-zenstack-access-control-at-the-orm-layer-built-for-coding-agents", "markdown": "https://wpnews.pro/news/show-hn-zenstack-access-control-at-the-orm-layer-built-for-coding-agents.md", "text": "https://wpnews.pro/news/show-hn-zenstack-access-control-at-the-orm-layer-built-for-coding-agents.txt", "jsonld": "https://wpnews.pro/news/show-hn-zenstack-access-control-at-the-orm-layer-built-for-coding-agents.jsonld"}}