> Is there also support for a code-first approach where these rules are stored in a (sanely human editable) text format.
We follow this approach. ACL is generated as JSON which then pass through REST & GraphQL middlewares. Completely extensible. Do watch us out [1]