atelier/domains/security/authorization.md

Authorization — Derived Rules

Derives from domains/security/first-principles.md P2 (Least Privilege), P3 (Defense in Depth), P1 (Zero Trust).

The Default: Deny

• Every request is denied unless explicitly authorized.
• "Authorized by default" is an anti-pattern. The absence of a rule means denial.
• A missing authz check is a bug, not a feature gap.

Authorization Models

RBAC (Role-Based)

• Users have roles; roles have permissions.
• Roles are coarse: admin, editor, viewer. Permissions are fine: post:create, post:delete.
• Check permissions, not roles: can(user, 'post:create'), not user.role === 'admin'.
• Roles can change; permission checks are stable.

ABAC (Attribute-Based)

• Authorization based on attributes of the user, resource, and context.
• More expressive: "user can edit a post if user.department == post.department and post.status == 'draft'".
• Use when RBAC is too coarse. Beware: complex ABAC is hard to audit.

ReBAC (Relationship-Based)

• Authorization based on relationships (e.g., Zanzibel).
• "user:alice is editor of document:42" — check the relationship graph.
• Scales for fine-grained, resource-specific access (Google Docs-style).

Where to Check (P4 Locality)

• Check at the boundary: the API endpoint, the resolver, the controller.
• Check at the data layer: defense in depth. A query that bypasses the controller still respects row-level security.
• Never check only in the UI. The UI is a convenience, not a security boundary.

Principle of Least Privilege (P2)

• A token/role gets the minimum permissions to do its job.
• No "admin" role for daily work. Admin is for administration; daily work uses a scoped role.
• Service tokens are scoped to one service's resources, not "all resources."

IDOR (Insecure Direct Object Reference) (P1 Zero Trust)

• /api/users/123 — does the requester own 123? Check.
• Never assume the user can access any ID they request. The ID is input; inputs are untrusted.
• Use scoped queries: User.find({ id, owner: userId }), not User.find(id).

Caching and Authz (P3 Defense in Depth)

• Authorization is not cached across users. A cached response for user A is not served to user B.
• Cache keys include the user/role, not just the resource.
• "Cache it as public if anyone can see it" — only if truly anyone (no auth).

What Violates Authorization

Violation	Principle
/admin endpoint with no authz check	P1 Zero Trust
user.role === 'admin' instead of permission check	P2 (roles change)
IDOR: User.find(req.params.id) with no ownership check	P1 Zero Trust
Cached authz decision reused across users	P3 Defense in Depth
Service token with "all resources" scope	P2 Least Privilege