authorization

Goal: enforce permissions consistently at every trust boundary. Use for: - deciding who can read or change what - choosing a model: roles, attributes, or relationships - fixing missing or inconsistent permission checks Workflow: 1. Define the resources, actions, and who may perform them. 2. Choose a model: RBAC, ABAC, or relationship-based (ReBAC). 3. Enforce checks server-side at every entry point. 4. Default to deny; grant explicitly. 5. Scope data queries to the caller's permissions. 6. Test allowed and forbidden paths, including escalation attempts. Patterns: - centralized policy checks, not scattered ad hoc ifs - ownership and tenant scoping on every query - least privilege for roles and service accounts - deny-by-default with explicit allow rules Rules: - never trust client-side authorization - check on the server at the data boundary, every time - default deny; make grants explicit and auditable - prevent IDOR by scoping queries to the authorized subject