Authorization checklist
Verify permission at the server boundary for every protected action.
- Authenticate the caller using a verified, non-expired session or token.
- Load the target resource and verify tenant, ownership, role, and action.
- Apply the same rules to bulk, export, background, and administrative paths.
- Return minimal information when access is denied.
- Log sensitive administrative decisions without logging secrets.
Key idea: Knowing an object identifier never grants permission to use it.