# Authorization

> Use when: design or review access control so users can only do what they are permitted to do.

- Skill: `kimtth/authorization` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kimtth/authorization`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kimtth/authorization/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: kimtth (https://skillmd.com/u/kimtth)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kimtth/authorization

---


Goal: enforce permissions consistently at every trust boundary.

Use for:
- deciding who can read or change what
- choosing a model: roles, attributes, or relationships
- fixing missing or inconsistent permission checks

Workflow:
1. Define the resources, actions, and who may perform them.
2. Choose a model: RBAC, ABAC, or relationship-based (ReBAC).
3. Enforce checks server-side at every entry point.
4. Default to deny; grant explicitly.
5. Scope data queries to the caller's permissions.
6. Test allowed and forbidden paths, including escalation attempts.

Patterns:
- centralized policy checks, not scattered ad hoc ifs
- ownership and tenant scoping on every query
- least privilege for roles and service accounts
- deny-by-default with explicit allow rules

Rules:
- never trust client-side authorization
- check on the server at the data boundary, every time
- default deny; make grants explicit and auditable
- prevent IDOR by scoping queries to the authorized subject