Ensure Authorized Requester for Business Logic Entry Points

Goal

Every business-logic entry point that requires authorization must include an ensure requester is authorized business constraint, placed after authentication and before any business operation runs.

This constraint follows the ensure ... formalism. Restate the rule as:

• ensure requester is authorized

Translate that formulation into the syntax, naming, and control-flow conventions of the language in use. The function name is always the same generic phrasing across entry points; the action-specific authorization policy lives inside the function body.

This constraint must be a module-private function, defined inside the same module as the business-logic entry point it protects. It is not exported, not reused across modules, and not accessible to other entry points.

On success the constraint returns a unit-equivalent value (no business data). On failure it returns an error indicating that the requester is not authorized to perform the action.

What Counts as In Scope

Apply this skill to code that does one or more of these things: