ZenStack
access control at the ORM layer, built for coding agents
Details
- External ID
- 48903199
- Source
- HN
- Company
- —
- Product
- ZenStack
- Website domain
- framer.website
- Launched
- July 14, 2026
- Cohort
- —
- Upvotes
- 8
- Upvotes percentile
- 0.46176821983273597
- Tags
- —
- Fetched at
- Sept. 7, 2026, 9:26 p.m.
- Updated at
- Sept. 7, 2026, 9:26 p.m.
Description
Hi HN, I'm Jiasheng, co-creator of ZenStack.Access control usually ends up scattered across app code instead of living with the data model — and that's riskier when the code is written by an agent, since it's easy to ship a query with a missing or incomplete authorization check. ZenStack enforces policy (RBAC/ABAC/relation-based) directly at the ORM layer, on top of Kysely, so every query gets checked the same way regardless of who wrote it and who is calling it.Postgres RLS is an option too, but it's hard to maintain and scale, and it's Postgres-only — ZenStack's approach is database-agnostic.One of our users, MermaidChart, put it well after launching their team feature on ZenStack: "much cleaner and easier to maintain than writing RLS policies or application-level checks that will surely leak after some time."Happy to answer anything.
Enrichment
- Theme
- database infrastructure and developer tools
- Vertical
- Horizontal
- Function
- Dev tools
- Audience
- Developer
- AI stance
- AI feature
- Project type
- Commercial product
- Normalized one-liner
- orm access control layer for ai coding agents
- Manually corrected
- False
Could you build this?
No ZenStack is a domain-specific modeling language compiler and runtime plugin engine that injects fine-grained access control directly into ORMs like Prisma.
What it would actually take: Built using TypeScript, custom DSL parser/generators (like Langium or Chevrotain), and deep AST manipulation to generate Prisma extensions and client-side access control proxies. The core difficulty is building an AST compiler that guarantees provably sound security filters, generates performant SQL subqueries without leaks, and maintains sync with evolving upstream ORM schemas.
Discussion
No comments on this launch.
Competitors
Other products that read as similar to this one — 39 launches clear the similarity bar, closest 8 shown.
Attention rank: #23 of 40 (itself plus its competitors, highest first — normalized so YC and Product Hunt are compared fairly).
Launched 257 days after the earliest competitor.
- Client SQL · ph · 2026-09-21 · 4 upvotes · similarity 0.50
- rmBug · hn · 2026-04-01 · 14 upvotes · similarity 0.41
- CipherStash Stack · hn · 2026-05-21 · 17 upvotes · similarity 0.38
- Control Claude permissions using a cloud-based decision table UI · hn · 2026-01-15 · 14 upvotes · similarity 0.37
- AI-first PostgreSQL client for Mac · hn · 2026-04-02 · 7 upvotes · similarity 0.37
- PgExtAssure · hn · 2026-08-22 · 5 upvotes · similarity 0.36
- DSGuard · ph · 2026-09-30 · 1 upvotes · similarity 0.36
- Dbmask · hn · 2026-09-10 · 5 upvotes · similarity 0.35
Other launches for this product
- No other launches for this product.
Same idea, different domain
Nobody's really built a dev tools tool for Sales yet.