authorization

name	authorization
description	Use when: design or review access control so users can only do what they are permitted to do.

Goal: enforce permissions consistently at every trust boundary.

Use for:

• deciding who can read or change what
• choosing a model: roles, attributes, or relationships
• fixing missing or inconsistent permission checks

Workflow:

1. Define the resources, actions, and who may perform them.
2. Choose a model: RBAC, ABAC, or relationship-based (ReBAC).
3. Enforce checks server-side at every entry point.
4. Default to deny; grant explicitly.
5. Scope data queries to the caller's permissions.
6. Test allowed and forbidden paths, including escalation attempts.

Patterns:

• centralized policy checks, not scattered ad hoc ifs
• ownership and tenant scoping on every query
• least privilege for roles and service accounts
• deny-by-default with explicit allow rules

Rules:

• never trust client-side authorization
• check on the server at the data boundary, every time
• default deny; make grants explicit and auditable
• prevent IDOR by scoping queries to the authorized subject