[0KnowledgeGoof]

My thoughts around that are to have all authorization and ownership encoded in database relations. I was thinking of a read-append-only table. This is a bit kooky maybe, but I experimented once with trying to make database constraints that verify a public key signature of the content of the record. One field containts signature of the user against the rest of the content of the record.

It was weird and ultimately at least Postgres couldn't support a cryptographic operation within a constraint, but it was fun to play with.

I make no claim any of this is practical right now, but I think there's at least theoeretical room to grow for that approach.

I'll look more into Phoenix! Thanks.

[_448]

> One field containts signature of the user against the rest of the content of the record.

What if there are multiple users authorised for that content?

[0KnowledgeGoof]

Hey, thanks for engaging and challenging my thought experiment. I think I could probably come up with a solution to that, but your point is made: this system will get arbitrarily complex very quickly. And require cryptography experts.

I definitely wouldn't do this for a Real Web App.