We are evaluating authorization architectures for a multi-tenant platform with complex role hierarchies and custom permission sets per tenant.

What are the pros and cons of implementing ABAC/RBAC via Open Policy Agent (OPA) / Zanzibar-style policy engines versus database-level row-level security (RLS) in terms of auditability, latency, and operational complexity?