How do people integrate these authz services with search, with its performance and filtering requirements? It seems like you have to offload search to authz, otherwise you have to deal with pagination-challenging pre- or post-filtering, or incorporate the authz logic into search. You need JOIN semantics, ideally with a context.