Access Control in Layers
5 parts, in reading order.
Access Control in Layers, Part 1: Two Checks on Every Request, Action and Scope
'Can this user do this?' is only half of authorisation. The other half is 'is this record theirs to touch?' Privileges and data scope fit together; the post covers where the scope should come from, what the extra lookup costs, and why a create needs a scope you actually hold.
Access Control in Layers, Part 2: Keep Privileges Out of the Token
If revocation has to be instant, a token should say who you are and nothing about what you can do. What goes wrong when privileges travel in the token, the cache-and-push design that replaces it, and why that cache becomes one of the most critical things you run.
Access Control in Layers, Part 3: Staff and Self-Service Users Are Different Users
Squeezing very different kinds of user into one role model makes both worse. Library staff and patrons at a self-service terminal want separate front doors: a narrow API for self-service users, and a split that makes each model simpler.
Access Control in Layers, Part 4: Service-to-Service Tokens Are Your Most Powerful Credentials
Internal tokens skip the user-level checks that protect everything else, which makes them more dangerous than any user's. Why services need them, what a leaked one can do, and how scoping, short lifetimes and careful issuing keep them in proportion.
Access Control in Layers, Part 5: Opt-In Security Checks Get Forgotten
A check that every new endpoint must remember to add will eventually be missed. The fix isn't more reviewers, it's making 'deny' the default and 'allow' something an endpoint has to ask for. The tests that assert what must be refused keep that default honest.