Authorization (RBAC)

Overview

Authentication says who you are; authorization says what you may do. Avoid if (role === "admin") sprinkled everywhere — it drifts and leaks. Define a single permission matrix mapping roles to actions, expose one typed can(role, action) helper, and call it on the server before every mutation. When rules outgrow roles, graduate to resource-level checks (ownership) without changing call sites.

When to use

• Different roles (owner/admin/member) get different capabilities.
• Any mutation needs a "is this user allowed?" check.
• You're comparing role strings inline in handlers or components.

The pattern