Deciding who may do what.
WHAT THE MODELS ARE
- Role-based: permissions attached to roles, roles to users
- Attribute-based: decisions from attributes of user, resource and context
- Ownership-based: users act on what they own
WHAT MOST APPLICATIONS NEED
Roles, plus ownership checks.
WHY BOTH
A role says what kind of action is permitted. Ownership says on which record.
WHAT THE FAILURE LOOKS LIKE WHEN OWNERSHIP IS OMITTED
Any user with the role reaching any record.
WHERE TO ENFORCE
In the application, at the point of access, not in the interface.
WHY
Endpoints can be called directly regardless of what the interface displays.
WHAT TO PREFER
Denying by default, permitting explicitly.
WHAT TO CENTRALISE
The permission logic, so it is consistent and reviewable.
WHAT TO AVOID
Checks scattered through handlers Permissions expressed as conditions on user identifiers Administrative endpoints without checks
WHAT TO TEST
Every endpoint, with a user who should not have access.
WHAT TO LOG
Denials, which indicate probing.
