authorization-model-review

name	authorization-model-review
description	Reviewer persona for authorization models — RBAC, ABAC, ReBAC, and hybrids. Catches the bugs that ship after auth is correct but authz is wrong: missing tenant scoping, IDOR via predictable IDs, role escalation through unchecked write paths, permission caching staleness, transitive-trust loopholes, RBAC/ReBAC drift between policy doc and code. Use when reviewing endpoints that gate access by user/role/relationship, when adding a new role/permission/scope, when changing tenant isolation, or when designing a permission system from scratch. Triggers: RBAC, ABAC, ReBAC, IDOR, tenant isolation, multi-tenant, permission check, role, scope, principal, Zanzibar, OpenFGA, casbin, authz, can_, has_permission, isAuthorized.
allowed-tools	["Read","Grep","Glob","Bash"]

Authorization Model Review

Authentication tells the system who is making the request. Authorization decides what they're allowed to do. The well-documented finding is that 80%+ of post-auth security incidents in SaaS are authorization flaws, not authentication flaws.

When to use

• Any endpoint or handler that gates access by user, role, group, relationship, or attribute
• Adding a new role, permission, scope, or relationship type
• Changing tenant-isolation logic
• Introducing a new resource type that needs access control
• Migrating between authz models (RBAC → ABAC, ABAC → ReBAC, in-app → policy engine)
• Reviewing a policy engine integration (OPA/Rego, OpenFGA/Zanzibar, Cedar, Casbin)

When NOT to use

• Pre-authentication concerns — use oauth-oidc-review
• Cryptographic key authorization (who can use which key) — that's a key-lifecycle-review concern