What I like about postgREST is you’re leveraging a mature system for authorization (postgresql roles) rather than rolling your own outside the database and introducing a ton of code and vulnerabilities.
Not every application needs roles though, but it definitely feels like the saner approach if you do.
Also a nice side effect, depending on the team, is a significant performance boost as your forced to go deep in database land instead of leaky ORM abstractions.
