kimtth Goal: enforce permissions consistently at every trust boundary.
Use for:
- deciding who can read or change what
- choosing a model: roles, attributes, or relationships
- fixing missing or inconsistent permission checks
Workflow:
- Define the resources, actions, and who may perform them.
- Choose a model: RBAC, ABAC, or relationship-based (ReBAC).
- Enforce checks server-side at every entry point.
- Default to deny; grant explicitly.
- Scope data queries to the caller's permissions.
- Test allowed and forbidden paths, including escalation attempts.
Patterns:
- centralized policy checks, not scattered ad hoc ifs
- ownership and tenant scoping on every query
- least privilege for roles and service accounts
- deny-by-default with explicit allow rules
Rules:
- never trust client-side authorization
- check on the server at the data boundary, every time
- default deny; make grants explicit and auditable
- prevent IDOR by scoping queries to the authorized subject