The situation is not as dire as it first appeared. While the messaging wasn't handled very well, where everything is settling out is good, with pluggable auth and an open source reference implementation: https://lakefs.io/blog/why-moving-acls-out-of-core-lakefs/