Hello, I'm creating a B2B SaaS application. I currently have an eng team of 2, with looking to add 2 more. We need to support up to 100-150 users over the next year or two. We will have pretty complex permissions for users, both on the frontend and backend. For example, sometimes a user with a certain role may be able to have whole sections of the UI not be visible, and then have pretty granular read/write permissions on components and backend changes even within the overall sections they can see. Our client admin users will need to be able to add/delete/modify user permissions within their company users.

I've taken a look at Auth0. It seems pretty heavy and possibly (?) too opinionated on what we want. It seems like there could potentially be a lot of boilerplate? I'm unsure about all the redirects they have around their Universal Login tool. We also won't be needing the functionality for users to "Sign up" directly, all user management will happen through our team or from within our platform. I like the idea that you get SSO out of the box. I also like that they have higher order components set up for use within a React application and examples on using it with React Router. I'm assuming it's not too hard to modify on the React side to account for complex user permissions? I guess trying to get feedback from anyone whose used it if they think it might apply or not to the use case I've spelled out here. When I first looked into it, it seemed like a time saver but I haven't been able to find many glowing reviews of it online.

Another option seems to be to roll our own solution using JWT and our own access control HoC in React with our own DB of users and API on the backend. Is there any particular tools or methods that people like when going more this route? Pros and cons?

Is there anything else out there that people like?

Sorry if I'm posting this in the wrong place or these questions aren't specific enough. Any help is appreciated.