> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spurtcommerce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permission

Action-level access control.

Permissions describe which operations a principal may perform. They are distinct from authentication and should be enforced server-side for every protected action.

## Permission model

Confirm whether v6 uses role-to-permission mappings, per-user grants, module permissions, or another policy model. Document the actual permission identifier, scope, and assignment workflow from the source.

## Enforcement checklist

* Check permissions in the backend, not only by hiding UI controls.
* Apply tenant and resource ownership checks in addition to action permission.
* Deny by default when policy data is missing or cannot be loaded.
* Avoid privilege escalation through mass assignment or user-controlled role fields.
* Audit grants, revocations, and privileged operations.

## Verify

Inspect authorization middleware/guards, role and permission entities, seed data, and route/controller annotations or checks.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.