Skip to main content

FediForum October 2026

Fundamental Operations Beyond CRUD

Topics Privacy & access control Protocols & standards

Convener: Kjetil Kjernsmo (@kjetil.kjernsmo.net)

Participants who chose to record their names here:

Introduction

In Solid, we had a panel that worked with use cases around access control and permissioning. Once that work was over, it was quite clear that a hard problem was that if you don’t have an elaborate access control system, only experts will be able to use it, but, we’re asking people to take a lot of responsibility for their own access controls.

Apart from that, there are things that can be done by developers, and one key is that if people only have access to a few primitives, they tend to overpermission. In Solid, we had Append as a subtype of Write, and I found we could extend these ideas to combat this problem, but it requires that we move beyond CRUD. In this idea, you can look at Create, Update and Delete as types of Writes, but you can also go deeper.

Solid: Ideas for access modes and corresponding operations in the Protocol: https://github.com/solid/authorization-panel/issues/253

Notes

  • Kjetil: Problem: asking people to start using access control systems, but those systems were designed for experts. Normal people aren’t ready to obtain the mental model necessary to use them.

    • Collected use cases and design considerations. Learned there were things that could be done to help.

      • Try to make people not over permission all the time.

        • If only appending to a file / resource, then you don’t need read access because you don’t need the data before. You also don’t need create or update or delete. You only need “append”.

          • Found something Novel Netware that had similar ideas: only giving a subset of permissions. Increases developer complexity, but not user complexity.

      • From the above GitHub link, the hierarchies proposed are:

        • Read:

          • List

        • Write:

          • Modify → Append → Create

          • Update → Extend

          • Delete

        • Control:

          • Read Permission

    • Jeremiah: One that comes to mind is proposed modification: it’s a write, but needs to be accepted.

  • Kjetil: Is CRUD too entrenched to be modified? What’s the next step? An implementation?

    • Kjetil has abandoned Solid after a decade of support

    • Jeremiah: Where would you want to implement it?

      • Kjetil: Quite a bit of overlap with ActivityPub. Solid as a superset of ActivityPub, but now looking into ATProto

      • Jeremiah: Why considering ATProto instead of ActivityPub?

  • Kjetil: recent experience setting up a company and assigning permissions, so is the company a user, with its own space permissions

    • Jeremiah: I don’t think ATProto, even with spaces, is the right model for that kind of data collaboration.

      • Working on something that has more group collaboration application-like use cases that uses NextGraph https://nextgraph.org/

  • Facebook groups are still a great feature that work well

Various modifications I can think of:

  • annotate / comment

  • insert

  • clip/crop

  • edit / regex operations

  • refactor

  • AI intervention

  • aggregate / join

Links: