> Authorization is far less likely to be something you get off the shelf and far more likely to be where you spend significant time

Agreed. It is business logic, which means that it is harder to do off the shelf.

That said, there are some startups trying to make this work. Here are the ones I'm aware of:

* permit.io

* cerbos.dev

* osohq.com

RBAC (role based access controls) can take you a long way for many applications, but at some point you will be more interested in ABAC (attribute based access control) or PBAC (policy based access control).

If you want to dig in more, this is a nice overview: https://bok.idpro.org/article/id/42/