Implementing access control (Scalekit FSA)

When to use

Use this Skill after authentication is working and the app must authorize access to routes/actions by inspecting the user's access token for roles and permissions. Scalekit can embed these authorization details in the access token during the authentication flow, so the app can make decisions without extra API calls. Always validate the token's integrity before trusting any embedded roles/permissions.

Workflow

1. Validate the access token (expiry, issuer/audience as applicable) and then decode it to extract sub, oid, roles, and permissions.
2. Attach a normalized auth context to the request (ele: req.user = { id, organizationId, roles, permissions }) so downstream handlers can authorize consistently.
3. Enforce authorization at route boundaries using (a) role checks for broad access patterns and (b) permission checks for fine-grained actions (often resource:action).
4. Combine checks when needed (examples: "admin bypass", "resource ownership", time-based restrictions for sensitive operations).
5. Never rely on client-side authorization alone; enforce roles/permissions server-side.

Reference implementation

Node.js (Express-style middleware)

Validate+extract, then RBAC/PBAC guards.