What would a "permissions-first ORM" look like? Looking for spec feedback

I haven't read through the entire thing yet, but looks conceptually similar to Zenstack (https://zenstack.dev) with the auth plugin and auto-generated APIs, so I'd be interested in a comparison with that.

Fwiw, I went down the path of trying to do something similar with Drizzle and gave up since it was in such a state of flux (this was last year). There are (were) a ton of edge cases around trying to add automatic filters to queries to the point that it was hard to justify not just rolling my own ORM.

Check out Zanzibar / SpiceDB / ReBAC and "Macaroon Auth" (disambiguating search phrase) for what modern permission systems can be