Skip to main content
Action-level access control. Permissions describe which operations a principal may perform. They are distinct from authentication and should be enforced server-side for every protected action.

Permission model

Confirm whether v6 uses role-to-permission mappings, per-user grants, module permissions, or another policy model. Document the actual permission identifier, scope, and assignment workflow from the source.

Enforcement checklist

  • Check permissions in the backend, not only by hiding UI controls.
  • Apply tenant and resource ownership checks in addition to action permission.
  • Deny by default when policy data is missing or cannot be loaded.
  • Avoid privilege escalation through mass assignment or user-controlled role fields.
  • Audit grants, revocations, and privileged operations.

Verify

Inspect authorization middleware/guards, role and permission entities, seed data, and route/controller annotations or checks.