We had around 200 permissions stored in every user's Redis session. The permissions were stored as plain-text strings, which meant every session was carrying more data than necessary. We considered three approaches: Numeric IDs: [0, 3, 22] A bitmask: one bit per permission A flag string: one character per permission We initially shipped a bitmask. It saved around 220 bytes, but introduced bit-shift arithmetic and byte-order conventions that made the representation harder to reason about. For that relatively small memory saving, the added complexity wasn't worth it. Instead, we simplified the representation and now store the permissions as ~200-character string. Net result: ~4.4 KB saved per session, a 95% reduction. Across N concurrent sessions [N × 4.4 KB].