One thing I’m not finding in this or similar tools is how to do row level authorization. For example: imagine a “forms” table. Users can submit forms and see and edit “their” forms, but not those of other users. Users need GET/POST/PUT /forms based on a UserId field in forms.

A more complex scenario: employees can submit forms. Managers can see forms for their employees, but not those of other managers. Managers need GET/POST/PUT on /forms based on forms.userid AND a relationship defined in manager_employees table. Managerid is not stored in forms because it could change.

Almost every api I’ve ever written has something along those lines. How would that be accomplished in a tool like this?