Backend Authorization

Purpose

Design and implement authorization that is correct, auditable, and maintainable. Every protected resource must have an explicit access decision. Authorization rules live in code or policy, never in the developer's head.

Architecture Decision Trees

Authorization Model Selection

How many resource types need access control?
├── < 10 → Flat RBAC (simple role-permission map)
└── >= 10 → Do roles map well to resources?
    ├── Yes → Does every user fit a single role?
    │   ├── Yes → Hierarchical RBAC (roles + inheritance)
    │   └── No → RBAC + ABAC hybrid (roles for coarse, attributes for exceptions)
    └── No → Does access depend on relationships between entities?
        ├── Yes → ReBAC (Zanzibar-style relationship tuples)
        └── No → ABAC (attribute-based policies for maximal flexibility)