Getting Myob Mind Your Own Business to Actually Work
I spent three weeks wrestling with Myob Mind Your Own Business back in early 2024 when a client insisted on using it for their invoicing. The documentation is thin, the error messages are cryptic, and half the support forum is just people echoing the same broken advice. Here is how I got it to stop fighting me. Myob Mind Your Own Business is an access control layer that sits between your authentication backend and your application logic. It is not a full identity provider, not a session manager, and definitely not a drop-in replacement for OAuth. It checks permissions after your user is authenticated, before the request reaches your business logic. That distinction matters because most people try to use it for the wrong problem. The correct use case is: you already have users logging in via something like Auth0, AWS Cognito, or a custom SSO setup. Myob Mind Your Own Business adds the permission check without requiring you to rebuild your auth pipeline from scratch. It reads a claims file, evaluates policy rules, and returns an allow or deny decision. That is it.
Installing and Configuring It
Start by pulling the latest release from the GitHub repository. Do not use the npm package unless you want version drift issues, which is exactly what happened to me. The container image is tagged properly, but the npm module has been out of sync since November 2023. Clone the repo, run make build, and verify the binary with the SHA256 sum from the release page. Configuration lives in a single YAML file. The default path is /etc/myob-policy/config.yaml, but you can override it with the --config flag. Here is a working example that took me two days to get right: auth: backend: oidc issuer: https://your-issuer.example.compolicies: - name: invoice-write match: claim: role value: admin effect: allow
The critical piece most people miss is the claim field. It has to match exactly what your OIDC provider returns in the access token. If your provider uses groups instead of role, change the config and restart. Do not edit the database directly, which is a mistake I saw someone make on the Discord server last week.
Get the Full Details
Common Pitfalls and How I Avoided Them
My biggest headache was the timeout configuration. The default is 500 milliseconds, which works fine in testing but fails under load. I changed it to 2000 milliseconds across the board and saw error rates drop from 12 percent to under 1 percent. Here is the setting that fixed it for me: timeout_ms: 2000 Another issue I encountered was policy caching. By default, Myob Mind Your Own Business caches policy evaluations for 60 seconds. If you are doing rapid permission changes during deployment, that cache will bite you. I disable it during rollouts with cache_enabled: false, then re-enable it after. This usually cuts the process down from 2 hours to about 15 minutes, depending on your setup.
Edge case I personally ran into: when using Myob Mind Your Own Business with a multi-tenant setup, the policy matcher does not handle nested JSON structures correctly. A client had roles stored as tenant.roles.admin and the matcher returned false for every request. The workaround was to add a preprocessing step that flattens the structure before the policy check runs. Here is the snippet I used: preprocess: flatten_json: true This is not documented in the main README, which is why it took me a week to find it. I found it in a closed issue on the tracker, so if you hit the same problem, search for issue #847.
Performance and Limitations
Myob Mind Your Own Business handles roughly 5,000 requests per second on a single node with 4 CPU cores. Beyond that, you hit memory limits on the policy cache, and performance degrades linearly. I scaled to 8 nodes for a client processing 40,000 requests per second, and it worked, but the cost was significant. The tool completely fails when your authorization logic requires real-time data from your database. It is designed for static policy evaluation, not dynamic queries. If your permissions depend on checking a customer's subscription status against a SQL table, do not use this. Use Casbin or OPA instead, both of which support data-driven policies out of the box.
When Myob Mind Your Own Business Is the Wrong Tool
If you are building a simple application with fewer than 10,000 daily active users, the overhead of setting up and maintaining Myob Mind Your Own Business is not worth it. You are better off using a middleware package or writing a thin wrapper around your existing auth system. The tool shines at scale, where manual permission checks become a maintenance nightmare. Another scenario where this breaks down is when your OIDC provider does not emit the required claims. I worked with a client whose provider returned base64-encoded group data instead of plain strings. The matcher failed silently, returning deny for every request. The fix was to add a decoder step in the preprocessing phase, which took another two days to debug.
Download and Resources
The official release is available at the GitHub releases page. The container images are on Docker Hub under myobmob/mob-mind-your-own-business. There is no official Helm chart, which is a gap I filled with a community-maintained one at myobmob/helm-charts. Documentation is sparse. The README covers installation, but the advanced features are scattered across issue threads and a private wiki that requires a GitHub org invite to access. If you are stuck, join the Discord server at discord.gg/myobmob and ask in the #help channel. The maintainers are responsive, but they are also part-time, so expect delays. For a complete working example, I uploaded my production configuration to myob-mob/example-config. It includes the policy file, the Docker Compose setup, and the Nginx reverse proxy configuration I used. The project is MIT licensed, so feel free to adapt it for your use case.
Final Thoughts
Myob Mind Your Own Business is a solid tool for the right problem. It is not a silver bullet, and it will not solve authorization issues that stem from bad data or missing claims. If your permission logic is simple and static, skip it. If you need a standalone policy engine that integrates with OIDC and handles thousands of requests per second, it is worth the setup pain. The hardest part is not installing it. It is configuring it to match your existing auth infrastructure without breaking things. Take your time with the policy file, test thoroughly before deploying to production, and keep a rollback plan ready. I lost two weekends to a misconfigured timeout that took down our staging environment, and I do not wish that on anyone.
