build1 distinct publisher
A collection-scoped Firestore role still reaches every collection beside it
The finest grain Firestore IAM offers is the whole database, so least privilege inside one is a property of your code rather than of the policy you wrote. One hackathon build shows what the alternative costs.
Publishers:dev.to
Reality
- Evidence40
- Adoption6
- Hype gap−25
- Incentives65