Separate identity proof from permission decisions.
Model subjects, resources, actions, and policy context.
Apply deny-by-default and least privilege.
Authentication establishes an identity; authorization decides whether that identity may perform an action on a resource. A policy decision should consider subject, action, resource, tenant, device or session context, and time where appropriate.
if (!authenticated(subject)) deny();
if (!policy.allows(subject, action, resource)) deny();
allow();
Never trust an object identifier merely because a user can change it. Enforce authorization on the server at every sensitive boundary, log meaningful decisions without secrets, and make default behavior deny access. Administrative access deserves stronger authentication and narrower scope.
Exercises
Write access rules for student, instructor, and administrator.
Find an insecure direct-object reference in a fictional API.
Specify audit events for permission changes.
Self-check
What does authentication answer?
What does authorization answer?
Why deny by default?
Self-Check Quiz
1. Can a logged-in user read every record?
AnswerNo. Authentication does not imply authorization; access must be checked for the specific action and resource.
2. What is least privilege?
AnswerGranting only the permissions required for an identity's legitimate tasks and no broader access.
Homework
Design authorization for a multi-tenant reporting API.
Write five allow and deny test cases.
Explain how you would prevent tenant data leakage.
Sample answerEvery query is scoped by the authenticated tenant and server-side policy, never only by a client-supplied tenant id. Tests cover same-tenant access, cross-tenant denial, missing identity, role changes, and resource ownership.